tests for suhosin.mail.protect

9 files changed, 160 insertions, 0 deletions

diff --git a/tests/misc/mailprotect_1_header_nl.phpt b/tests/misc/mailprotect_1_header_nl.phpt
new file mode 100644
index 0000000..c8f1bc0
--- /dev/null
+++ b/tests/misc/mailprotect_1_header_nl.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=1 and extra headers start with newline
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=1
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "subject", "msg", "\r\nFoo: bar"));
+?>
+--EXPECTF--
+ALERT - mail() - double newline in headers, possible injection, mail dropped (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_1_header_nlnl.phpt b/tests/misc/mailprotect_1_header_nlnl.phpt
new file mode 100644
index 0000000..cd0083f
--- /dev/null
+++ b/tests/misc/mailprotect_1_header_nlnl.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=1 and extra headers contain double newline
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=1
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "subject", "msg", "Foo: bar\r\n\r\nfake-msg-start"));
+?>
+--EXPECTF--
+ALERT - mail() - double newline in headers, possible injection, mail dropped (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_1_subject.phpt b/tests/misc/mailprotect_1_subject.phpt
new file mode 100644
index 0000000..e43791c
--- /dev/null
+++ b/tests/misc/mailprotect_1_subject.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=1 with NL in Subject
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=1
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "sub\nject", "msg"));
+?>
+--EXPECTF--
+ALERT - mail() - newline in Subject header, possible injection, mail dropped (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_1_subject_long.phpt b/tests/misc/mailprotect_1_subject_long.phpt
new file mode 100644
index 0000000..dc11783
--- /dev/null
+++ b/tests/misc/mailprotect_1_subject_long.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Testing: suhosin.mail.protect=1 with valid long Subject
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=1
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "sub\n ject\r\n\tfoo", "msg"));
+?>
+--EXPECTF--
+bool(true)
diff --git a/tests/misc/mailprotect_1_to.phpt b/tests/misc/mailprotect_1_to.phpt
new file mode 100644
index 0000000..59b5202
--- /dev/null
+++ b/tests/misc/mailprotect_1_to.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=1 with NL in To
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=1
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("t\r\no", "subject", "msg"));
+?>
+--EXPECTF--
+ALERT - mail() - newline in To header, possible injection, mail dropped (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_1_to_long.phpt b/tests/misc/mailprotect_1_to_long.phpt
new file mode 100644
index 0000000..9fb08a0
--- /dev/null
+++ b/tests/misc/mailprotect_1_to_long.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Testing: suhosin.mail.protect=1 with valid long To
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=1
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to\n long\r\n\tfoo", "subject", "msg"));
+?>
+--EXPECTF--
+bool(true)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_2_bcc.phpt b/tests/misc/mailprotect_2_bcc.phpt
new file mode 100644
index 0000000..f13bcbb
--- /dev/null
+++ b/tests/misc/mailprotect_2_bcc.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=2 and extra headers contain Bcc:
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=2
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "subject", "msg", "Bcc: me"));
+?>
+--EXPECTF--
+ALERT - mail() - BCC: headers aren't allowed in the headers parameter. (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_2_cc.phpt b/tests/misc/mailprotect_2_cc.phpt
new file mode 100644
index 0000000..960b271
--- /dev/null
+++ b/tests/misc/mailprotect_2_cc.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=2 and extra headers contain Cc:
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=2
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "subject", "msg", "Cc: me"));
+?>
+--EXPECTF--
+ALERT - mail() - CC: headers aren't allowed in the headers parameter. (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file
diff --git a/tests/misc/mailprotect_2_to.phpt b/tests/misc/mailprotect_2_to.phpt
new file mode 100644
index 0000000..8723b6f
--- /dev/null
+++ b/tests/misc/mailprotect_2_to.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Testing: suhosin.mail.protect=2 and extra headers contain To:
+--SKIPIF--
+<?php include "../skipifnotcli.inc"; ?>
+--INI--
+suhosin.log.sapi=255
+suhosin.log.stdout=0
+suhosin.log.script=0
+suhosin.log.syslog=0
+suhosin.mail.protect=2
+sendmail_path=/usr/bin/true
+--FILE--
+<?php
+        var_dump(mail("to", "subject", "msg", "To: me"));
+?>
+--EXPECTF--
+ALERT - mail() - To: headers aren't allowed in the headers parameter. (attacker 'REMOTE_ADDR not set', file '%s', line 2)
+bool(false)
\ No newline at end of file