summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--tests/executor/eval_blacklist.phpt18
-rw-r--r--tests/executor/eval_blacklist_printf.phpt16
-rw-r--r--tests/executor/eval_blacklist_printf_function_exists.phpt23
-rw-r--r--tests/executor/eval_whitelist_absmax.phpt16
-rw-r--r--tests/executor/eval_whitelist_call_user_func.phpt15
-rw-r--r--tests/executor/function_whitelist_absmax.phpt (renamed from tests/executor/function_whiletist_absmax.phpt)0
-rw-r--r--tests/include/include_blacklist.phpt24
-rw-r--r--tests/include/include_blackwhitelist_empty.phpt24
-rw-r--r--tests/include/include_whitelist.phpt24
9 files changed, 160 insertions, 0 deletions
diff --git a/tests/executor/eval_blacklist.phpt b/tests/executor/eval_blacklist.phpt
new file mode 100644
index 0000000..586bebc
--- /dev/null
+++ b/tests/executor/eval_blacklist.phpt
@@ -0,0 +1,18 @@
1--TEST--
2Testing: suhosin.executor.eval.blacklist=max
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_eval=0
8suhosin.executor.eval.blacklist=max
9--FILE--
10<?php
11 eval('abs(1);
12 max(1,2);
13 abs(1);');
14?>
15--EXPECTF--
16ALERT - function within eval blacklist called: max() (attacker 'REMOTE_ADDR not set', file '%s', line 4)
17
18Warning: max() has been disabled for security reasons in %s : eval()'d code on line 2
diff --git a/tests/executor/eval_blacklist_printf.phpt b/tests/executor/eval_blacklist_printf.phpt
new file mode 100644
index 0000000..596036e
--- /dev/null
+++ b/tests/executor/eval_blacklist_printf.phpt
@@ -0,0 +1,16 @@
1--TEST--
2Testing: suhosin.executor.eval.blacklist=printf via call_user_func
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_eval=0
8suhosin.executor.eval.blacklist=printf
9--FILE--
10<?php
11 eval('call_user_func("printf", "hello\n");');
12?>
13--EXPECTF--
14ALERT - function within eval blacklist called: printf() (attacker 'REMOTE_ADDR not set', file '%s : eval()'d code', line 1)
15
16Warning: printf() has been disabled for security reasons in %s : eval()'d code on line 1
diff --git a/tests/executor/eval_blacklist_printf_function_exists.phpt b/tests/executor/eval_blacklist_printf_function_exists.phpt
new file mode 100644
index 0000000..d9b842c
--- /dev/null
+++ b/tests/executor/eval_blacklist_printf_function_exists.phpt
@@ -0,0 +1,23 @@
1--TEST--
2Testing: suhosin.executor.eval.blacklist=printf with function_exists()
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_eval=0
8suhosin.executor.eval.blacklist=printf,max
9--FILE--
10<?php
11 eval('var_dump(function_exists("abs"));');
12 eval('var_dump(function_exists("max"));');
13 eval('var_dump(function_exists("ord"));');
14 eval('var_dump(function_exists("printf"));');
15 eval('var_dump(function_exists("chr"));');
16?>
17--EXPECTF--
18bool(true)
19bool(false)
20bool(true)
21bool(false)
22bool(true)
23
diff --git a/tests/executor/eval_whitelist_absmax.phpt b/tests/executor/eval_whitelist_absmax.phpt
new file mode 100644
index 0000000..fff7345
--- /dev/null
+++ b/tests/executor/eval_whitelist_absmax.phpt
@@ -0,0 +1,16 @@
1--TEST--
2Testing: suhosin.executor.eval.whitelist=abs,max
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.disable_eval=0
8suhosin.executor.eval.whitelist=abs,max
9--FILE--
10<?php
11 eval('abs(1);
12 max(1,2);
13 abs(1);');
14?>
15--EXPECTF--
16
diff --git a/tests/executor/eval_whitelist_call_user_func.phpt b/tests/executor/eval_whitelist_call_user_func.phpt
new file mode 100644
index 0000000..6f09b50
--- /dev/null
+++ b/tests/executor/eval_whitelist_call_user_func.phpt
@@ -0,0 +1,15 @@
1--TEST--
2Testing: suhosin.executor.eval.whitelist=printf via call_user_func
3--SKIPIF--
4<?php include "../skipifnotcli.inc"; ?>
5--INI--
6suhosin.log.sapi=64
7suhosin.executor.eval.whitelist=call_user_func
8--FILE--
9<?php
10 eval('call_user_func("printf", "hello\n");');
11?>
12--EXPECTF--
13ALERT - function outside of eval whitelist called: printf() (attacker 'REMOTE_ADDR not set', file '%s : eval()'d code', line 1)
14
15Warning: printf() has been disabled for security reasons in %s : eval()'d code on line 1
diff --git a/tests/executor/function_whiletist_absmax.phpt b/tests/executor/function_whitelist_absmax.phpt
index f240e69..f240e69 100644
--- a/tests/executor/function_whiletist_absmax.phpt
+++ b/tests/executor/function_whitelist_absmax.phpt
diff --git a/tests/include/include_blacklist.phpt b/tests/include/include_blacklist.phpt
new file mode 100644
index 0000000..f4c3df0
--- /dev/null
+++ b/tests/include/include_blacklist.phpt
@@ -0,0 +1,24 @@
1--TEST--
2Include blacklist
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=foo,boo
12--FILE--
13<?php
14 $var = "file://" . dirname(__FILE__) . "/../empty.inc";
15 include $var;
16 echo $value,"\n";
17 $var = "foo://test";
18 include $var;
19 $var = "boo://test"; // this point is never reached (famous last words)
20 include $var;
21?>
22--EXPECTF--
23value-from-empty.inc
24ALERT - Include filename ('foo://test') is a URL that is forbidden by the blacklist (attacker 'REMOTE_ADDR not set', file '%s', line 6) \ No newline at end of file
diff --git a/tests/include/include_blackwhitelist_empty.phpt b/tests/include/include_blackwhitelist_empty.phpt
new file mode 100644
index 0000000..33380fd
--- /dev/null
+++ b/tests/include/include_blackwhitelist_empty.phpt
@@ -0,0 +1,24 @@
1--TEST--
2Include URL with empty black-/whitelist
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = dirname(__FILE__) . "/../empty.inc";
15 include $var;
16 echo $value,"\n";
17 $var = "foo://test";
18 include $var;
19 $var = "boo://test"; // this point is never reached (famous last words)
20 include $var;
21?>
22--EXPECTF--
23value-from-empty.inc
24ALERT - Include filename ('foo://test') is a URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 6) \ No newline at end of file
diff --git a/tests/include/include_whitelist.phpt b/tests/include/include_whitelist.phpt
new file mode 100644
index 0000000..a0c771f
--- /dev/null
+++ b/tests/include/include_whitelist.phpt
@@ -0,0 +1,24 @@
1--TEST--
2Include whitelist
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=0
9suhosin.log.phpscript=0
10suhosin.executor.include.whitelist=file
11suhosin.executor.include.blacklist=
12--FILE--
13<?php
14 $var = "file://" . dirname(__FILE__) . "/../empty.inc";
15 include $var;
16 echo $value,"\n";
17 $var = "foo://test";
18 include $var;
19 $var = "boo://test"; // this point is never reached (famous last words)
20 include $var;
21?>
22--EXPECTF--
23value-from-empty.inc
24ALERT - Include filename ('foo://test') is a URL that is not allowed (attacker 'REMOTE_ADDR not set', file '%s', line 6) \ No newline at end of file