summaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
authorStefan Esser2010-02-21 11:44:54 +0100
committerStefan Esser2010-02-21 11:44:54 +0100
commit36dbfacbe64697d959f524e537b15b73c090d898 (patch)
treef1c7ce1409b0e7765fc72d550546967fcf0f9717 /tests
Inital commit
Diffstat (limited to 'tests')
-rw-r--r--tests/empty.inc3
-rw-r--r--tests/executor/disable_emod_off.phpt18
-rw-r--r--tests/executor/disable_emod_on.phpt19
-rw-r--r--tests/executor/disable_eval_off.phpt15
-rw-r--r--tests/executor/disable_eval_on.phpt17
-rw-r--r--tests/executor/memory_limit.phpt29
-rw-r--r--tests/executor/memory_limit_other_hardlimit.phpt28
-rw-r--r--tests/executor/negative_memory_limit.phpt18
-rw-r--r--tests/executor/preg_replace.phpt30
-rw-r--r--tests/executor/preg_replace_error.phpt32
-rw-r--r--tests/executor/recursion_maxdepth.phpt31
-rw-r--r--tests/filter/get_globals.phpt24
-rw-r--r--tests/funcs/crypt_blowfish.phpt13
-rw-r--r--tests/funcs/crypt_ext_des.phpt12
-rw-r--r--tests/funcs/crypt_md5.phpt11
-rw-r--r--tests/funcs/crypt_std_des.phpt11
-rw-r--r--tests/funcs/sha256.phpt40
-rw-r--r--tests/include/include_constant.phpt17
-rw-r--r--tests/include/include_etc_passwd.phpt23
-rw-r--r--tests/include/include_once_constant.phpt17
-rw-r--r--tests/include/include_once_tmpvar.phpt19
-rw-r--r--tests/include/include_once_var.phpt18
-rw-r--r--tests/include/include_tmpvar.phpt19
-rw-r--r--tests/include/include_var.phpt18
-rw-r--r--tests/include/require_constant.phpt17
-rw-r--r--tests/include/require_once_constant.phpt17
-rw-r--r--tests/include/require_once_tmpvar.phpt19
-rw-r--r--tests/include/require_once_var.phpt18
-rw-r--r--tests/include/require_tmpvar.phpt19
-rw-r--r--tests/include/require_var.phpt18
-rw-r--r--tests/skipif.inc4
-rw-r--r--tests/skipifcli.inc8
-rw-r--r--tests/skipifnotcli.inc8
33 files changed, 610 insertions, 0 deletions
diff --git a/tests/empty.inc b/tests/empty.inc
new file mode 100644
index 0000000..35cbf45
--- /dev/null
+++ b/tests/empty.inc
@@ -0,0 +1,3 @@
1<?php
2 $value = "value-from-empty.inc";
3?> \ No newline at end of file
diff --git a/tests/executor/disable_emod_off.phpt b/tests/executor/disable_emod_off.phpt
new file mode 100644
index 0000000..3c9cb01
--- /dev/null
+++ b/tests/executor/disable_emod_off.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Testing: suhosin.executor.disable_emodifier=0
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_emodifier=0
8--FILE--
9<?php
10 $text = "HALLO";
11 var_dump(preg_replace('/[a-z]/e', "strtoupper('\\0')", $text));
12 $text = "HalLO";
13 var_dump(preg_replace('/[a-z]/e', "strtoupper('\\0')", $text));
14?>
15--EXPECTF--
16string(5) "HALLO"
17string(5) "HALLO"
18
diff --git a/tests/executor/disable_emod_on.phpt b/tests/executor/disable_emod_on.phpt
new file mode 100644
index 0000000..6daf82f
--- /dev/null
+++ b/tests/executor/disable_emod_on.phpt
@@ -0,0 +1,19 @@
1--TEST--
2Testing: suhosin.executor.disable_emodifier=1
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_emodifier=1
8--FILE--
9<?php
10 $text = "HALLO";
11 var_dump(preg_replace('/[a-z]/e', "strtoupper('\\0')", $text));
12 $text = "HalLO";
13 var_dump(preg_replace('/[a-z]/e', "strtoupper('\\0')", $text));
14?>
15--EXPECTF--
16string(5) "HALLO"
17ALERT - use of preg_replace() with /e modifier is forbidden by configuration (attacker 'REMOTE_ADDR not set', file '%s', line 5)
18
19Fatal error: SUHOSIN - Use of preg_replace() with /e modifier is forbidden by configuration in %s(5) : regexp code on line 5
diff --git a/tests/executor/disable_eval_off.phpt b/tests/executor/disable_eval_off.phpt
new file mode 100644
index 0000000..1ee87f5
--- /dev/null
+++ b/tests/executor/disable_eval_off.phpt
@@ -0,0 +1,15 @@
1--TEST--
2Testing: suhosin.executor.disable_eval=0
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_eval=0
8--FILE--
9<?php
10 $x = 0;
11 eval('$x = 1;');
12 var_dump($x);
13?>
14--EXPECTF--
15int(1)
diff --git a/tests/executor/disable_eval_on.phpt b/tests/executor/disable_eval_on.phpt
new file mode 100644
index 0000000..49f4936
--- /dev/null
+++ b/tests/executor/disable_eval_on.phpt
@@ -0,0 +1,17 @@
1--TEST--
2Testing: suhosin.executor.disable_eval=1
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_eval=1
8--FILE--
9<?php
10 $x = 0;
11 eval('$x = 1;');
12 var_dump($x);
13?>
14--EXPECTF--
15ALERT - use of eval is forbidden by configuration (attacker 'REMOTE_ADDR not set', file '%s', line 3)
16
17Fatal error: SUHOSIN - Use of eval is forbidden by configuration in %s(3) : eval()'d code on line 3
diff --git a/tests/executor/memory_limit.phpt b/tests/executor/memory_limit.phpt
new file mode 100644
index 0000000..404ab19
--- /dev/null
+++ b/tests/executor/memory_limit.phpt
@@ -0,0 +1,29 @@
1--TEST--
2memory_limit test: set suhosin hard_limit to normal limit
3--SKIPIF--
4<?php if (!function_exists("memory_get_usage")) print "skip PHP not compiled with memory_limit support"; ?>
5--INI--
6memory_limit=16M
7suhosin.memory_limit=0
8suhosin.log.syslog=0
9suhosin.log.script=0
10suhosin.log.sapi=2
11--FILE--
12<?php
13 ini_set("memory_limit", "13M"); echo ini_get("memory_limit"), "\n";
14 ini_set("memory_limit", "14M"); echo ini_get("memory_limit"), "\n";
15 ini_set("memory_limit", "15M"); echo ini_get("memory_limit"), "\n";
16 ini_set("memory_limit", "16M"); echo ini_get("memory_limit"), "\n";
17 ini_set("memory_limit", "17M"); echo ini_get("memory_limit"), "\n";
18 ini_set("memory_limit", "18M"); echo ini_get("memory_limit"), "\n";
19?>
20--EXPECTF--
2113M
2214M
2315M
2416M
25ALERT - script tried to increase memory_limit to 17825792 bytes which is above the allowed value (attacker 'REMOTE_ADDR not set', file '%s', line 6)
2616M
27ALERT - script tried to increase memory_limit to 18874368 bytes which is above the allowed value (attacker 'REMOTE_ADDR not set', file '%s', line 7)
2816M
29
diff --git a/tests/executor/memory_limit_other_hardlimit.phpt b/tests/executor/memory_limit_other_hardlimit.phpt
new file mode 100644
index 0000000..cac11dc
--- /dev/null
+++ b/tests/executor/memory_limit_other_hardlimit.phpt
@@ -0,0 +1,28 @@
1--TEST--
2memory_limit test: set suhosin hard_limit to normal limit + 1M
3--SKIPIF--
4<?php if (!function_exists("memory_get_usage")) print "skip PHP not compiled with memory_limit support"; ?>
5--INI--
6memory_limit=16M
7suhosin.memory_limit=17M
8suhosin.log.syslog=0
9suhosin.log.script=0
10suhosin.log.sapi=2
11--FILE--
12<?php
13 ini_set("memory_limit", "13M"); echo ini_get("memory_limit"), "\n";
14 ini_set("memory_limit", "14M"); echo ini_get("memory_limit"), "\n";
15 ini_set("memory_limit", "15M"); echo ini_get("memory_limit"), "\n";
16 ini_set("memory_limit", "16M"); echo ini_get("memory_limit"), "\n";
17 ini_set("memory_limit", "17M"); echo ini_get("memory_limit"), "\n";
18 ini_set("memory_limit", "18M"); echo ini_get("memory_limit"), "\n";
19?>
20--EXPECTF--
2113M
2214M
2315M
2416M
2517M
26ALERT - script tried to increase memory_limit to %d bytes which is above the allowed value (attacker 'REMOTE_ADDR not set', file '%s', line 7)
2717M
28
diff --git a/tests/executor/negative_memory_limit.phpt b/tests/executor/negative_memory_limit.phpt
new file mode 100644
index 0000000..8582cc9
--- /dev/null
+++ b/tests/executor/negative_memory_limit.phpt
@@ -0,0 +1,18 @@
1--TEST--
2memory_limit test: trying to set memory_limit to a negative value
3--SKIPIF--
4<?php if (!function_exists("memory_get_usage")) print "skip PHP not compiled with memory_limit support"; ?>
5--INI--
6memory_limit=16M
7suhosin.memory_limit=17M
8suhosin.log.syslog=0
9suhosin.log.script=0
10suhosin.log.sapi=2
11--FILE--
12<?php
13 ini_set("memory_limit", "-200000"); echo ini_get("memory_limit"), "\n";
14?>
15--EXPECTF--
16ALERT - script tried to increase memory_limit to %d bytes which is above the allowed value (attacker 'REMOTE_ADDR not set', file '%s', line 2)
1716M
18
diff --git a/tests/executor/preg_replace.phpt b/tests/executor/preg_replace.phpt
new file mode 100644
index 0000000..9060a29
--- /dev/null
+++ b/tests/executor/preg_replace.phpt
@@ -0,0 +1,30 @@
1--TEST--
2Testing protection against "\0" in preg_replace() first parameter
3--SKIPIF--
4<?php include "../skipif.inc"; ?>
5--INI--
6suhosin.log.sapi=0
7--FILE--
8<?php
9
10 $text1 = "One little boy with two dogs, three cats and four birds";
11 $text2 = "The three cats eat the four birds";
12
13 $regex_array = array("/one/", "/two/", "/three/");
14 $regex_array0 = array("/one/\0", "/two/", "/three/");
15 $replace_array = array("1", "2", "3");
16 $regex = "/eat/";
17 $regex0 = "/ea\0t/";
18 $replace = "play with";
19
20 var_dump(preg_replace($regex_array, $replace_array, $text1));
21 var_dump(preg_replace($regex_array0, $replace_array, $text1));
22 var_dump(preg_replace($regex, $replace, $text2));
23 var_dump(preg_replace($regex0, $replace, $text2));
24
25?>
26--EXPECT--
27string(49) "One little boy with 2 dogs, 3 cats and four birds"
28bool(false)
29string(39) "The three cats play with the four birds"
30bool(false)
diff --git a/tests/executor/preg_replace_error.phpt b/tests/executor/preg_replace_error.phpt
new file mode 100644
index 0000000..39e0aee
--- /dev/null
+++ b/tests/executor/preg_replace_error.phpt
@@ -0,0 +1,32 @@
1--TEST--
2Testing protection against "\0" in preg_replace() first parameter (INCL. SUHOSIN ERROR MESSAGES)
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7--FILE--
8<?php
9
10 $text1 = "One little boy with two dogs, three cats and four birds";
11 $text2 = "The three cats eat the four birds";
12
13 $regex_array = array("/one/", "/two/", "/three/");
14 $regex_array0 = array("/one/\0", "/two/", "/three/");
15 $replace_array = array("1", "2", "3");
16 $regex = "/eat/";
17 $regex0 = "/ea\0t/";
18 $replace = "play with";
19
20 var_dump(preg_replace($regex_array, $replace_array, $text1));
21 var_dump(preg_replace($regex_array0, $replace_array, $text1));
22 var_dump(preg_replace($regex, $replace, $text2));
23 var_dump(preg_replace($regex0, $replace, $text2));
24
25?>
26--EXPECTF--
27string(49) "One little boy with 2 dogs, 3 cats and four birds"
28ALERT - string termination attack on first preg_replace parameter detected (attacker 'REMOTE_ADDR not set', file '%s', line 14)
29bool(false)
30string(39) "The three cats play with the four birds"
31ALERT - string termination attack on first preg_replace parameter detected (attacker 'REMOTE_ADDR not set', file '%s', line 16)
32bool(false)
diff --git a/tests/executor/recursion_maxdepth.phpt b/tests/executor/recursion_maxdepth.phpt
new file mode 100644
index 0000000..31fe9c2
--- /dev/null
+++ b/tests/executor/recursion_maxdepth.phpt
@@ -0,0 +1,31 @@
1--TEST--
2Testing: suhosin.executor.max_depth
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.max_depth=13
8--FILE--
9<?php
10 function rec($level)
11 {
12 echo $level,"\n";
13 rec(++$level);
14 }
15
16 rec(2);
17?>
18--EXPECTF--
192
203
214
225
236
247
258
269
2710
2811
2912
3013
31ALERT - maximum execution depth reached - script terminated (attacker 'REMOTE_ADDR not set', file '%s', line 5)
diff --git a/tests/filter/get_globals.phpt b/tests/filter/get_globals.phpt
new file mode 100644
index 0000000..f16991b
--- /dev/null
+++ b/tests/filter/get_globals.phpt
@@ -0,0 +1,24 @@
1--TEST--
2Testing: GLOBALS in GET
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=255
9suhosin.log.script.name=/tmp/xx
10--GET--
11a=1&b=2&GLOBALS=123&c=3
12--FILE--
13<?php
14 var_dump($_GET['a']);
15 var_dump($_GET['b']);
16 var_dump($_GET['c']);
17 if (!isset($_GET['GLOBALS'])) var_dump(5);
18 else var_dump(0);
19?>
20--EXPECT--
21string(1) "1"
22string(1) "2"
23string(1) "3"
24int(5)
diff --git a/tests/funcs/crypt_blowfish.phpt b/tests/funcs/crypt_blowfish.phpt
new file mode 100644
index 0000000..f48e411
--- /dev/null
+++ b/tests/funcs/crypt_blowfish.phpt
@@ -0,0 +1,13 @@
1--TEST--
2CRYPT_BLOWFISH support
3--SKIPIF--
4<?php include "../skipif.inc"; ?>
5--FILE--
6<?php
7 var_dump(CRYPT_BLOWFISH);
8 echo crypt('rasmuslerdorf', '$2a$07$rasmuslerd...........$') . "\n";
9?>
10--EXPECT--
11int(1)
12$2a$07$rasmuslerd............nIdrcHdxcUxWomQX9j6kvERCFjTg7Ra
13
diff --git a/tests/funcs/crypt_ext_des.phpt b/tests/funcs/crypt_ext_des.phpt
new file mode 100644
index 0000000..4e2ba73
--- /dev/null
+++ b/tests/funcs/crypt_ext_des.phpt
@@ -0,0 +1,12 @@
1--TEST--
2CRYPT_EXT_DES support
3--SKIPIF--
4<?php if (CRYPT_EXT_DES == 0) print 'skip'; ?>
5--FILE--
6<?php
7 echo crypt('rasmuslerdorf', '_J9..rasm') . "\n"
8?>
9--EXPECT--
10_J9..rasmBYk8r9AiWNc
11
12
diff --git a/tests/funcs/crypt_md5.phpt b/tests/funcs/crypt_md5.phpt
new file mode 100644
index 0000000..fd39d20
--- /dev/null
+++ b/tests/funcs/crypt_md5.phpt
@@ -0,0 +1,11 @@
1--TEST--
2CRYPT_MD5 support
3--SKIPIF--
4<?php if (CRYPT_MD5 == 0) print 'skip'; ?>
5--FILE--
6<?php
7 echo crypt('rasmuslerdorf', '$1$rasmusle$') . "\n"
8?>
9--EXPECT--
10$1$rasmusle$rISCgZzpwk3UhDidwXvin0
11
diff --git a/tests/funcs/crypt_std_des.phpt b/tests/funcs/crypt_std_des.phpt
new file mode 100644
index 0000000..926ec44
--- /dev/null
+++ b/tests/funcs/crypt_std_des.phpt
@@ -0,0 +1,11 @@
1--TEST--
2CRYPT_STD_DES support
3--SKIPIF--
4<?php if (CRYPT_STD_DES == 0) print 'skip'; ?>
5--FILE--
6<?php
7 echo crypt('rasmuslerdorf', 'rl') . "\n"
8?>
9--EXPECT--
10rl.3StKT.4T8M
11
diff --git a/tests/funcs/sha256.phpt b/tests/funcs/sha256.phpt
new file mode 100644
index 0000000..cb407b1
--- /dev/null
+++ b/tests/funcs/sha256.phpt
@@ -0,0 +1,40 @@
1--TEST--
2SHA256 support
3--SKIPIF--
4<?php include "../skipif.inc"; ?>
5--FILE--
6<?php
7 echo sha256("") , "\n";
8 echo sha256("a"), "\n";
9 echo sha256(pack("H*", "bd")), "\n";
10 echo sha256(pack("H*", "5fd4")), "\n";
11 echo sha256(pack("H*", "b0bd69")), "\n";
12 echo sha256(pack("H*", "c98c8e55")), "\n";
13 echo sha256(pack("H*", "81a723d966")), "\n";
14 echo sha256(pack("H*", "c97a2db566e5")), "\n";
15 echo sha256(pack("H*", "f53210aa6ed72e")), "\n";
16 echo sha256(pack("H*", "0df1cd526b5a4edd")), "\n";
17 echo sha256(pack("H*", "b80233e2c53ab32cc3")), "\n";
18 echo sha256(pack("H*", "5d54ed5b52d879aeb5dd")), "\n";
19 echo sha256(pack("H*", "df866ecb67ab00515f6247")), "\n";
20 echo sha256(pack("H*", "0757de9485a2eaea51126077")), "\n";
21 echo sha256(pack("H*", "7c66f5d443c11cfb39dd0aa715")), "\n";
22 echo sha256(pack("H*", "329624fed35639fe54957b7d47a9")), "\n";
23?>
24--EXPECT--
25e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
26ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
2768325720aabd7c82f30f554b313d0570c95accbb7dc4b5aae11204c08ffe732b
287c4fbf484498d21b487b9d61de8914b2eadaf2698712936d47c3ada2558f6788
294096804221093ddccfbf46831490ea63e9e99414858f8d75ff7f642c7ca61803
307abc22c0ae5af26ce93dbb94433a0e0b2e119d014f8e7f65bd56c61ccccd9504
317516fb8bb11350df2bf386bc3c33bd0f52cb4c67c6e4745e0488e62c2aea2605
320eb0281b27a4604709b0513b43ad29fdcff9a7a958554abc689d7fe35af703e4
33dee684641421d1ba5a65c71f986a117cbb3d619a052a0b3409306c629575c00f
3447f527210d6e8f940b5082fec01b7305908fa2b49ea3ae597c19a3986097153c
35c60d239cc6da3ad31f4de0c2d58a73ccf3f9279e504fa60ad55a31dcf686f3ca
36e0164d90dbfcf173bb88044fac596ccd03b8d247c79907aaa5701767fad7b576
37dc990ef3109a7bcf626199db9ab7801213ceb0ad2ee398963b5061e39c05c7b5
38c1c9a4daadcc8678835872c7f1f8824376ac7b412e1fc2285069b41afd51397e
396840619417b4d8ecaa7902f8eaf2e82be2638dec97cb7e8fcc377007cc176718
400f5308ff22b828e18bd65afbc427e3c1a678962832519df5f2f803f68f55e10b
diff --git a/tests/include/include_constant.phpt b/tests/include/include_constant.phpt
new file mode 100644
index 0000000..180aa69
--- /dev/null
+++ b/tests/include/include_constant.phpt
@@ -0,0 +1,17 @@
1--TEST--
2Include "Constant URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 include "http://127.0.0.1/";
15?>
16--EXPECTF--
17ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 2)
diff --git a/tests/include/include_etc_passwd.phpt b/tests/include/include_etc_passwd.phpt
new file mode 100644
index 0000000..fb3c4e2
--- /dev/null
+++ b/tests/include/include_etc_passwd.phpt
@@ -0,0 +1,23 @@
1--TEST--
2Include "../../../../../../../../../../../etc/passwd";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12suhosin.executor.include.max_traversal=3
13--FILE--
14<?php
15 $var = dirname(__FILE__)."/../empty.inc";
16 include $var;
17 echo $value,"\n";
18 $var = dirname(__FILE__)."/../../../../../../../../../../../etc/passwd";
19 include $var;
20?>
21--EXPECTF--
22value-from-empty.inc
23ALERT - Include filename ('%s../../../../../../../../../../../etc/passwd') contains too many '../' (attacker 'REMOTE_ADDR not set', file '%s', line 6)
diff --git a/tests/include/include_once_constant.phpt b/tests/include/include_once_constant.phpt
new file mode 100644
index 0000000..3faac33
--- /dev/null
+++ b/tests/include/include_once_constant.phpt
@@ -0,0 +1,17 @@
1--TEST--
2Include_once "Constant URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 include_once "http://127.0.0.1/";
15?>
16--EXPECTF--
17ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 2)
diff --git a/tests/include/include_once_tmpvar.phpt b/tests/include/include_once_tmpvar.phpt
new file mode 100644
index 0000000..1f94c5a
--- /dev/null
+++ b/tests/include/include_once_tmpvar.phpt
@@ -0,0 +1,19 @@
1--TEST--
2Include_once "Temp Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 $app = "?";
16 include_once $var.$app;
17?>
18--EXPECTF--
19ALERT - Include filename ('http://127.0.0.1/?') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 4)
diff --git a/tests/include/include_once_var.phpt b/tests/include/include_once_var.phpt
new file mode 100644
index 0000000..bf38377
--- /dev/null
+++ b/tests/include/include_once_var.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Include_once "Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 include_once $var;
16?>
17--EXPECTF--
18ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 3)
diff --git a/tests/include/include_tmpvar.phpt b/tests/include/include_tmpvar.phpt
new file mode 100644
index 0000000..8ad26d7
--- /dev/null
+++ b/tests/include/include_tmpvar.phpt
@@ -0,0 +1,19 @@
1--TEST--
2Include "Temp Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 $app = "?";
16 include $var.$app;
17?>
18--EXPECTF--
19ALERT - Include filename ('http://127.0.0.1/?') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 4)
diff --git a/tests/include/include_var.phpt b/tests/include/include_var.phpt
new file mode 100644
index 0000000..7431240
--- /dev/null
+++ b/tests/include/include_var.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Include "Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 include $var;
16?>
17--EXPECTF--
18ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 3)
diff --git a/tests/include/require_constant.phpt b/tests/include/require_constant.phpt
new file mode 100644
index 0000000..6ee79fb
--- /dev/null
+++ b/tests/include/require_constant.phpt
@@ -0,0 +1,17 @@
1--TEST--
2Require "Constant URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 require "http://127.0.0.1/";
15?>
16--EXPECTF--
17ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 2)
diff --git a/tests/include/require_once_constant.phpt b/tests/include/require_once_constant.phpt
new file mode 100644
index 0000000..43c69c8
--- /dev/null
+++ b/tests/include/require_once_constant.phpt
@@ -0,0 +1,17 @@
1--TEST--
2Require_once "Constant URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 require_once "http://127.0.0.1/";
15?>
16--EXPECTF--
17ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 2)
diff --git a/tests/include/require_once_tmpvar.phpt b/tests/include/require_once_tmpvar.phpt
new file mode 100644
index 0000000..2be24b2
--- /dev/null
+++ b/tests/include/require_once_tmpvar.phpt
@@ -0,0 +1,19 @@
1--TEST--
2Require_once "Temp Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 $app = "?";
16 require_once $var.$app;
17?>
18--EXPECTF--
19ALERT - Include filename ('http://127.0.0.1/?') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 4)
diff --git a/tests/include/require_once_var.phpt b/tests/include/require_once_var.phpt
new file mode 100644
index 0000000..b3857f5
--- /dev/null
+++ b/tests/include/require_once_var.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Require_once "Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 require_once $var;
16?>
17--EXPECTF--
18ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 3)
diff --git a/tests/include/require_tmpvar.phpt b/tests/include/require_tmpvar.phpt
new file mode 100644
index 0000000..d411067
--- /dev/null
+++ b/tests/include/require_tmpvar.phpt
@@ -0,0 +1,19 @@
1--TEST--
2Require "Temp Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 $app = "?";
16 require $var.$app;
17?>
18--EXPECTF--
19ALERT - Include filename ('http://127.0.0.1/?') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 4)
diff --git a/tests/include/require_var.phpt b/tests/include/require_var.phpt
new file mode 100644
index 0000000..20468d4
--- /dev/null
+++ b/tests/include/require_var.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Require "Variable URL";
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "http://127.0.0.1/";
15 require $var;
16?>
17--EXPECTF--
18ALERT - Include filename ('http://127.0.0.1/') is an URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 3)
diff --git a/tests/skipif.inc b/tests/skipif.inc
new file mode 100644
index 0000000..fd0598c
--- /dev/null
+++ b/tests/skipif.inc
@@ -0,0 +1,4 @@
1<?php
2if(!extension_loaded("suhosin"))
3 print "skip - SUHOSIN extension not available";
4?>
diff --git a/tests/skipifcli.inc b/tests/skipifcli.inc
new file mode 100644
index 0000000..63b41ca
--- /dev/null
+++ b/tests/skipifcli.inc
@@ -0,0 +1,8 @@
1<?php
2if (php_sapi_name()=='cli') {
3 print 'skip - SAPI == cli';
4} else {
5if(!extension_loaded("suhosin"))
6 print "skip - SUHOSIN extension not available";
7}
8?>
diff --git a/tests/skipifnotcli.inc b/tests/skipifnotcli.inc
new file mode 100644
index 0000000..823cb91
--- /dev/null
+++ b/tests/skipifnotcli.inc
@@ -0,0 +1,8 @@
1<?php
2if (php_sapi_name()!='cli') {
3 print 'skip - SAPI != cli';
4} else {
5if(!extension_loaded("suhosin"))
6 print "skip - SUHOSIN extension not available";
7}
8?>