summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStefan Esser2014-02-16 10:45:17 +0100
committerStefan Esser2014-02-16 10:45:17 +0100
commit04f02a230d40c2d86b9d477a7810de24b15a7590 (patch)
tree845b75d12015b95ad2a566bb9ef94e4e731543f1
parent2bf085a8d27a5b9a05a0164fcc0c1ea41e78c601 (diff)
Add various tests for include filename checks
Diffstat
-rw-r--r--tests/include/include_max_traversal.phpt32
-rw-r--r--tests/include/include_nul_in_filename.phpt23
-rw-r--r--tests/include/include_too_long.phpt18
-rw-r--r--tests/include/include_uploaded_file_diff_filename.phpt25
-rw-r--r--tests/include/include_uploaded_file_from_FILES.phpt25
5 files changed, 123 insertions, 0 deletions
diff --git a/tests/include/include_max_traversal.phpt b/tests/include/include_max_traversal.phpt
new file mode 100644
index 0000000..1ed083d
--- /dev/null
+++ b/tests/include/include_max_traversal.phpt
@@ -0,0 +1,32 @@
1--TEST--
2Testing suhosin.executor.include.max_traversal=10
3--DESCRIPTION--
4Seems to work fine, maybe split up later into multiple test cases.
5--SKIPIF--
6<?php include "../skipifcli.inc"; ?>
7--INI--
8suhosin.log.syslog=0
9suhosin.log.sapi=255
10suhosin.log.script=0
11suhosin.log.phpscript=0
12error_reporting=0
13suhosin.executor.include.whitelist=
14suhosin.executor.include.blacklist=
15suhosin.executor.include.max_traversal=10
16--FILE--
17<?php
18if ($included === TRUE) { echo "$case INCLUDED!\n";return; }
19$included = TRUE;
20
21$case = "C1"; include("/../../../../../../../../../" . __FILE__);
22$case = "C2"; include("/.././.././.././.././.././.././.././.././../" . __FILE__);
23$case = "C3"; include("/.././.././.././.././.././.././.././.././.././../" . __FILE__);
24$case = "C4"; include("/../../../../../../../../../../" . __FILE__);
25$case = "C5"; include("/../../../../../../../../../../../" . __FILE__);
26$case = "C6"; include("/.././.././.././.././.././.././.././.././../" . __FILE__);
27
28?>
29--EXPECTF--
30C1 INCLUDED!
31C2 INCLUDED!
32ALERT - Include filename ('/.././.././.././.././.././.././.././.././.././../%s') contains too many '../' (attacker 'REMOTE_ADDR not set', file '%s', line 7)
diff --git a/tests/include/include_nul_in_filename.phpt b/tests/include/include_nul_in_filename.phpt
new file mode 100644
index 0000000..05c2823
--- /dev/null
+++ b/tests/include/include_nul_in_filename.phpt
@@ -0,0 +1,23 @@
1--TEST--
2Testing include of filename including ASCIIZ character
3--DESCRIPTION--
4
5This test will only trigger the PHP internal protection.
6If this test case ever breaks then PHP has failed and hopefully Suhosin has kicked in.
7
8--SKIPIF--
9<?php include "../skipifcli.inc"; ?>
10--INI--
11suhosin.log.syslog=0
12suhosin.log.sapi=255
13suhosin.log.script=0
14suhosin.log.phpscript=0
15suhosin.executor.include.whitelist=
16suhosin.executor.include.blacklist=
17--FILE--
18<?php
19$filename1 = "AAAA".chr(0)."AAAA";
20include $filename1;
21?>
22--EXPECTF--
23Warning: include(): Failed opening 'AAAA' for inclusion (include_path='%s') in %s on line 3 \ No newline at end of file
diff --git a/tests/include/include_too_long.phpt b/tests/include/include_too_long.phpt
new file mode 100644
index 0000000..91c9958
--- /dev/null
+++ b/tests/include/include_too_long.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Testing include of too long filename
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14$filename1 = str_repeat("A", PHP_MAXPATHLEN+1);
15include $filename1;
16?>
17--EXPECTF--
18ALERT - Include filename ('AAAA%sAAAA') is too long (attacker 'REMOTE_ADDR not set', file '%s', line 3) \ No newline at end of file
diff --git a/tests/include/include_uploaded_file_diff_filename.phpt b/tests/include/include_uploaded_file_diff_filename.phpt
new file mode 100644
index 0000000..8d3bca5
--- /dev/null
+++ b/tests/include/include_uploaded_file_diff_filename.phpt
@@ -0,0 +1,25 @@
1--TEST--
2Testing include file from $_FILES (but change name a bit)
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.log.phpscript=0
11suhosin.executor.include.whitelist=
12suhosin.executor.include.blacklist=
13--POST_RAW--
14Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
15-----------------------------20896060251896012921717172737
16Content-Disposition: form-data; name="f1"; filename="filename2"
17
18<?php echo "NO_GOOD/n";
19-----------------------------20896060251896012921717172737--
20--FILE--
21<?php
22include "/../../../" . $_FILES['f1']['tmp_name'];
23?>
24--EXPECTF--
25ALERT - Include filename is an uploaded file (attacker 'REMOTE_ADDR not set', file '%s', line 2) \ No newline at end of file
diff --git a/tests/include/include_uploaded_file_from_FILES.phpt b/tests/include/include_uploaded_file_from_FILES.phpt
new file mode 100644
index 0000000..1ec20f3
--- /dev/null
+++ b/tests/include/include_uploaded_file_from_FILES.phpt
@@ -0,0 +1,25 @@
1--TEST--
2Testing include file from $_FILES
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.log.phpscript=0
11suhosin.executor.include.whitelist=
12suhosin.executor.include.blacklist=
13--POST_RAW--
14Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
15-----------------------------20896060251896012921717172737
16Content-Disposition: form-data; name="f1"; filename="filename2"
17
18<?php echo "NO_GOOD/n";
19-----------------------------20896060251896012921717172737--
20--FILE--
21<?php
22include $_FILES['f1']['tmp_name'];
23?>
24--EXPECTF--
25ALERT - Include filename is an uploaded file (attacker 'REMOTE_ADDR not set', file '%s', line 2) \ No newline at end of file