diff options
| author |   Marc Alexander <admin@m-a-styles.de> | 2015-01-21 00:16:42 +0100 |
|---|---|---|
| committer |   Andreas Fischer <bantu@phpbb.com> | 2015-01-21 01:02:08 +0100 |
| commit | 4b9434bf1ba4c015da11309602cfccf1a9c2493c (patch) | |
| tree | bf18c2f664c124d459a99282c2387b12e0508f46 /tests/security | |
| parent | Merge pull request #3312 from bantu/ticket/13527 (diff) | |
| download | phpbb-4b9434bf1ba4c015da11309602cfccf1a9c2493c.tar.gz phpbb-4b9434bf1ba4c015da11309602cfccf1a9c2493c.tar.bz2 phpbb-4b9434bf1ba4c015da11309602cfccf1a9c2493c.zip | |
[ticket/13531] Explicitly disallow trailing paths (e.g. PATH_INFO).
PHPBB3-13531
Diffstat (limited to 'tests/security')
| -rw-r--r-- | tests/security/trailing_path_test.php | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/tests/security/trailing_path_test.php b/tests/security/trailing_path_test.php new file mode 100644 index 0000000000..72ec6b8816 --- /dev/null +++ b/tests/security/trailing_path_test.php @@ -0,0 +1,55 @@ +<?php +/** + * + * @package testing + * @copyright (c) 2011 phpBB Group + * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2 + * + */ + +require_once dirname(__FILE__) . '/../../phpBB/includes/startup.php'; + +class phpbb_security_trailing_path_test extends phpbb_test_case +{ + public function data_has_trailing_path() + { + return array( + array(false, '', '', ''), + array(true, '/', '', ''), + array(true, '/foo', '', ''), + array(true, '', '/foo', ''), + array(true, '/foo', '/foo', ''), + array(false, '', '', '/'), + array(false, '', '', '/?/x.php/'), + array(false, '', '', '/index.php'), + array(false, '', '', '/dir.phpisfunny/foo.php'), + array(true, '', '', '/index.php/foo.php'), + array(false, '', '', '/phpBB/viewtopic.php?f=3&t=5'), + array(false, '', '', '/phpBB/viewtopic.php?f=3&t=5/'), + array(false, '', '', '/phpBB/viewtopic.php?f=3&t=5/foo'), + array(true, '/foo', '/foo', '/phpBB/viewtopic.php?f=3&t=5/foo'), + array(false, '', '', '/projects/php.bb/phpBB/viewtopic.php?f=3&t=5/'), + array(false, '', '', '/projects/php.bb/phpBB/viewtopic.php?f=3&t=5'), + array(false, '', '', '/projects/php.bb/phpBB/viewtopic.php?f=3&t=5/foo.php/'), + array(false, '', '', '/projects/php.bb/phpBB/index.php'), + array(true, '', '', '/projects/php.bb/phpBB/index.php/'), + array(true, '', '', '/phpBB/index.php/?foo/a'), + array(true, '', '', '/projects/php.bb/phpBB/index.php/?a=5'), + array(false, '', '', '/projects/php.bb/phpBB/index.php?/a=5'), + ); + } + + /** + * @dataProvider data_has_trailing_path + */ + public function test_has_trailing_path($expected, $path_info, $orig_path_info, $request_uri) + { + global $phpEx; + + $_SERVER['PATH_INFO'] = $path_info; + $_SERVER['ORIG_PATH_INFO'] = $orig_path_info; + $_SERVER['REQUEST_URI'] = $request_uri; + + $this->assertSame($expected, phpbb_has_trailing_path($phpEx)); + } +} |