Inital commit

1 files changed, 23 insertions, 0 deletions

diff --git a/tests/include/include_etc_passwd.phpt b/tests/include/include_etc_passwd.phpt
new file mode 100644
index 0000000..fb3c4e2
--- /dev/null
+++ b/tests/include/include_etc_passwd.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Include "../../../../../../../../../../../etc/passwd";
+--SKIPIF--
+<?php include "../skipifcli.inc"; ?>
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=255
+suhosin.log.script=0
+suhosin.log.phpscript=0
+suhosin.executor.include.whitelist=
+suhosin.executor.include.blacklist=
+suhosin.executor.include.max_traversal=3
+--FILE--
+<?php
+        $var = dirname(__FILE__)."/../empty.inc";
+        include $var;
+        echo $value,"\n";
+    $var = dirname(__FILE__)."/../../../../../../../../../../../etc/passwd";
+    include $var;
+?>
+--EXPECTF--
+value-from-empty.inc
+ALERT - Include filename ('%s../../../../../../../../../../../etc/passwd') contains too many '../' (attacker 'REMOTE_ADDR not set', file '%s', line 6)