From 7b3cfa84ff15cc0d4d84f33974c8120aaad0246f Mon Sep 17 00:00:00 2001
From: Stefan Esser
Date: Wed, 12 Feb 2014 17:42:37 +0100
Subject: Add testcase for server variables filter

---
 tests/filter/server_filter.phpt | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 tests/filter/server_filter.phpt

(limited to 'tests/filter')

diff --git a/tests/filter/server_filter.phpt b/tests/filter/server_filter.phpt
new file mode 100644
index 0000000..b1271bd
--- /dev/null
+++ b/tests/filter/server_filter.phpt
@@ -0,0 +1,33 @@
+--TEST--
+suhosin SERVER filter
+--INI--
+suhosin.log.syslog=0
+suhosin.log.sapi=0
+suhosin.log.stdout=255
+suhosin.log.script=0
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--ENV--
+return <<<END
+HTTP_POST_VARS=HTTP_POST_VARS
+HTTP_MY_VARS=HTTP_MY_VARS
+HTTP_GET_VARS=HTTP_GET_VARS
+HTTP_ENV_VARS=HTTP_ENV_VARS
+HTTP_SERVER_VARS=HTTP_SERVER_VARS
+HTTP_SESSION_VARS=HTTP_SESSION_VARS
+HTTP_COOKIE_VARS=HTTP_COOKIE_VARS
+HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA
+HTTP_POST_FILES=HTTP_POST_FILES
+END;
+--COOKIE--
+--GET--
+--POST--
+--FILE--
+<?php
+foreach ($_SERVER as $k => $v) {
+	if (!strncmp($k, "HTTP_", 5)) echo "$k => $v\n";
+}
+?>
+--EXPECTF--
+HTTP_MY_VARS => HTTP_MY_VARS
+ALERT - Attacker tried to overwrite a superglobal through a HTTP header (attacker 'REMOTE_ADDR not set', file '%s')
\ No newline at end of file
-- 
cgit v1.3