summaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
authorBen Fuhrmannek2016-03-07 23:29:21 +0100
committerBen Fuhrmannek2016-03-07 23:29:21 +0100
commita17a53b490bd5127a7ec67063a31b186e6956805 (patch)
treef64e5e866940e47b6c054f4bbf9fa342377a7517 /tests
parentf2788a5543f72cdbe5fafd95ea7b37fab06745e3 (diff)
session support
Diffstat (limited to 'tests')
-rw-r--r--tests/session/PHPSESSID_max_id_length_ok.phpt16
-rw-r--r--tests/session/PHPSESSID_max_id_length_toolong.phpt16
-rw-r--r--tests/session/crypt.checkraddr_4.phpt29
-rw-r--r--tests/session/crypt.checkraddr_4_incorrect.phpt27
-rw-r--r--tests/session/crypt.docroot.phpt25
-rw-r--r--tests/session/crypt.key_default.phpt21
-rw-r--r--tests/session/crypt.key_empty.phpt21
-rw-r--r--tests/session/crypt.key_empty_remote_addr.phpt25
-rw-r--r--tests/session/crypt.no_encryption.phpt15
-rw-r--r--tests/session/crypt.raddr_1.phpt25
-rw-r--r--tests/session/crypt.raddr_2.phpt25
-rw-r--r--tests/session/crypt.raddr_3.phpt25
-rw-r--r--tests/session/crypt.raddr_4.phpt25
-rw-r--r--tests/session/crypt.ua.phpt25
-rw-r--r--tests/session/max_id_length_ok.phpt16
-rw-r--r--tests/session/max_id_length_toolong.phpt15
-rw-r--r--tests/session/session_recursive_crash.phpt25
-rw-r--r--tests/session/session_recursive_crash2.phpt61
-rw-r--r--tests/session/sessionhandler.inc43
19 files changed, 480 insertions, 0 deletions
diff --git a/tests/session/PHPSESSID_max_id_length_ok.phpt b/tests/session/PHPSESSID_max_id_length_ok.phpt
new file mode 100644
index 0000000..2673d08
--- /dev/null
+++ b/tests/session/PHPSESSID_max_id_length_ok.phpt
@@ -0,0 +1,16 @@
1--TEST--
2PHPSESSID session id not too long
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.max_id_length=32
7session.hash_bits_per_character=4
8--COOKIE--
9PHPSESSID=12345678901234567890123456789012;
10--FILE--
11<?php
12session_start();
13echo session_id();
14?>
15--EXPECTF--
1612345678901234567890123456789012 \ No newline at end of file
diff --git a/tests/session/PHPSESSID_max_id_length_toolong.phpt b/tests/session/PHPSESSID_max_id_length_toolong.phpt
new file mode 100644
index 0000000..6bd71fb
--- /dev/null
+++ b/tests/session/PHPSESSID_max_id_length_toolong.phpt
@@ -0,0 +1,16 @@
1--TEST--
2PHPSESSID session id too long
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.max_id_length=32
7session.hash_bits_per_character=4
8--COOKIE--
9PHPSESSID=123456789012345678901234567890123;
10--FILE--
11<?php
12session_start();
13echo strlen(session_id());
14?>
15--EXPECTF--
1632 \ No newline at end of file
diff --git a/tests/session/crypt.checkraddr_4.phpt b/tests/session/crypt.checkraddr_4.phpt
new file mode 100644
index 0000000..42ac96a
--- /dev/null
+++ b/tests/session/crypt.checkraddr_4.phpt
@@ -0,0 +1,29 @@
1--TEST--
2session encryption with checkraddr=4
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.1
8PHPSESSID=test
9END;
10--INI--
11suhosin.session.encrypt=On
12suhosin.session.cryptkey=D3F4UL7
13suhosin.session.cryptua=Off
14suhosin.session.cryptdocroot=Off
15suhosin.session.cryptraddr=0
16suhosin.session.checkraddr=4
17--FILE--
18<?php
19include "sessionhandler.inc";
20
21session_test_start(new RemoteAddrSessionHandler());
22var_dump($_SESSION);
23
24?>
25--EXPECTF--
26array(1) {
27 ["a"]=>
28 string(1) "b"
29}
diff --git a/tests/session/crypt.checkraddr_4_incorrect.phpt b/tests/session/crypt.checkraddr_4_incorrect.phpt
new file mode 100644
index 0000000..cc468b8
--- /dev/null
+++ b/tests/session/crypt.checkraddr_4_incorrect.phpt
@@ -0,0 +1,27 @@
1--TEST--
2session encryption with checkraddr=4 and incorrect REMOTE_ADDR
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.2
8PHPSESSID=test
9END;
10--INI--
11suhosin.session.encrypt=On
12suhosin.session.cryptkey=D3F4UL7
13suhosin.session.cryptua=Off
14suhosin.session.cryptdocroot=Off
15suhosin.session.cryptraddr=0
16suhosin.session.checkraddr=4
17--FILE--
18<?php
19include "sessionhandler.inc";
20
21session_test_start(new RemoteAddrSessionHandler());
22var_dump($_SESSION);
23
24?>
25--EXPECTF--
26array(0) {
27}
diff --git a/tests/session/crypt.docroot.phpt b/tests/session/crypt.docroot.phpt
new file mode 100644
index 0000000..d5b6fc6
--- /dev/null
+++ b/tests/session/crypt.docroot.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption using docroot
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7DOCUMENT_ROOT=/var/www
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=Off
13suhosin.session.cryptdocroot=On
14suhosin.session.cryptraddr=0
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: NKChb1rdctXd-Acz0uzOYVnJT_J2mxYRVUgSh0w5mlk.
diff --git a/tests/session/crypt.key_default.phpt b/tests/session/crypt.key_default.phpt
new file mode 100644
index 0000000..8e4f12a
--- /dev/null
+++ b/tests/session/crypt.key_default.phpt
@@ -0,0 +1,21 @@
1--TEST--
2session with encryption default key
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.encrypt=On
7suhosin.session.cryptkey=D3F4UL7
8suhosin.session.cryptua=Off
9suhosin.session.cryptdocroot=Off
10suhosin.session.cryptraddr=0
11suhosin.session.checkraddr=0
12--FILE--
13<?php
14include "sessionhandler.inc";
15session_test_start();
16$_SESSION['a'] = 'b';
17
18
19?>
20--EXPECTF--
21SESSION: RIuy2LSSd3_s3hhDCnN89bNWyCnhvNAO0YUq7OQKuJc.
diff --git a/tests/session/crypt.key_empty.phpt b/tests/session/crypt.key_empty.phpt
new file mode 100644
index 0000000..3e5da11
--- /dev/null
+++ b/tests/session/crypt.key_empty.phpt
@@ -0,0 +1,21 @@
1--TEST--
2session with encryption key empty
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.encrypt=On
7suhosin.session.cryptkey=
8suhosin.session.cryptua=Off
9suhosin.session.cryptdocroot=Off
10suhosin.session.cryptraddr=0
11suhosin.session.checkraddr=0
12--FILE--
13<?php
14include "sessionhandler.inc";
15session_test_start();
16$_SESSION['a'] = 'b';
17
18
19?>
20--EXPECTF--
21SESSION: RIuy2LSSd3_s3hhDCnN89bNWyCnhvNAO0YUq7OQKuJc.
diff --git a/tests/session/crypt.key_empty_remote_addr.phpt b/tests/session/crypt.key_empty_remote_addr.phpt
new file mode 100644
index 0000000..cf1292a
--- /dev/null
+++ b/tests/session/crypt.key_empty_remote_addr.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption key empty and REMOTE_ADDR set
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.1
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=
12suhosin.session.cryptua=Off
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=0
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: j1YTvIOAUqxZMjuJ_ZnHPHWY5XEayycsr7O94aMzmBQ.
diff --git a/tests/session/crypt.no_encryption.phpt b/tests/session/crypt.no_encryption.phpt
new file mode 100644
index 0000000..6b6bc97
--- /dev/null
+++ b/tests/session/crypt.no_encryption.phpt
@@ -0,0 +1,15 @@
1--TEST--
2session without encryption
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.encrypt=Off
7--FILE--
8<?php
9include "sessionhandler.inc";
10session_test_start();
11$_SESSION['a'] = 'b';
12
13?>
14--EXPECTF--
15SESSION: a|s:1:"b"; \ No newline at end of file
diff --git a/tests/session/crypt.raddr_1.phpt b/tests/session/crypt.raddr_1.phpt
new file mode 100644
index 0000000..2070d03
--- /dev/null
+++ b/tests/session/crypt.raddr_1.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption using REMOTE_ADDR (cryptraddr=1)
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.1
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=Off
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=1
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: wkiQGgZgWnBFDyCs_4QYD_oaw_m35l_5I35XRg0wX_g.
diff --git a/tests/session/crypt.raddr_2.phpt b/tests/session/crypt.raddr_2.phpt
new file mode 100644
index 0000000..b8c21bc
--- /dev/null
+++ b/tests/session/crypt.raddr_2.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption using REMOTE_ADDR (cryptraddr=2)
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.1
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=Off
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=2
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: WDyvE0R4mUqvOG6e5VzhfgWMjfCWSFC5bNNI_3dIT3w.
diff --git a/tests/session/crypt.raddr_3.phpt b/tests/session/crypt.raddr_3.phpt
new file mode 100644
index 0000000..afe2729
--- /dev/null
+++ b/tests/session/crypt.raddr_3.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption using REMOTE_ADDR (cryptraddr=3)
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.1
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=Off
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=3
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: 6kLKLrgCmlOuEPXPON_K5SWHLuIbHdLsh4MJ0QtTFj8.
diff --git a/tests/session/crypt.raddr_4.phpt b/tests/session/crypt.raddr_4.phpt
new file mode 100644
index 0000000..28b4098
--- /dev/null
+++ b/tests/session/crypt.raddr_4.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption using REMOTE_ADDR (cryptraddr=4)
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7REMOTE_ADDR=127.0.0.1
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=Off
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=4
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: QYSbWh8enETvdtKfao8G6aiXqK7_lhzFmRNYa2lo-UM.
diff --git a/tests/session/crypt.ua.phpt b/tests/session/crypt.ua.phpt
new file mode 100644
index 0000000..4c53273
--- /dev/null
+++ b/tests/session/crypt.ua.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session with encryption using ua
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7HTTP_USER_AGENT=test
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=On
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=0
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18include "sessionhandler.inc";
19session_test_start();
20$_SESSION['a'] = 'b';
21
22
23?>
24--EXPECTF--
25SESSION: 3pVZdIv7vHG-PwO_rLQLUGerd4L_UX60xJoAM-IoVC4.
diff --git a/tests/session/max_id_length_ok.phpt b/tests/session/max_id_length_ok.phpt
new file mode 100644
index 0000000..dbecebd
--- /dev/null
+++ b/tests/session/max_id_length_ok.phpt
@@ -0,0 +1,16 @@
1--TEST--
2session id not too long
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.max_id_length=32
7session.hash_bits_per_character=4
8session.use_strict_mode=0
9--FILE--
10<?php
11session_id('12345678901234567890123456789012');
12session_start();
13echo session_id();
14?>
15--EXPECTF--
1612345678901234567890123456789012
diff --git a/tests/session/max_id_length_toolong.phpt b/tests/session/max_id_length_toolong.phpt
new file mode 100644
index 0000000..a8ec4cc
--- /dev/null
+++ b/tests/session/max_id_length_toolong.phpt
@@ -0,0 +1,15 @@
1--TEST--
2session id too long
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.session.max_id_length=32
7session.hash_bits_per_character=4
8--FILE--
9<?php
10session_id('123456789012345678901234567890123');
11session_start();
12echo strlen(session_id());
13?>
14--EXPECTF--
1532 \ No newline at end of file
diff --git a/tests/session/session_recursive_crash.phpt b/tests/session/session_recursive_crash.phpt
new file mode 100644
index 0000000..62cb9cd
--- /dev/null
+++ b/tests/session/session_recursive_crash.phpt
@@ -0,0 +1,25 @@
1--TEST--
2session SessionHandler() recursive crash
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7HTTP_USER_AGENT=test
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=On
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=0
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18session_set_save_handler(new SessionHandler(), true);
19$_SESSION['a'] = 'b';
20var_dump($_SESSION);
21--EXPECTF--
22array(1) {
23 ["a"]=>
24 string(1) "b"
25}
diff --git a/tests/session/session_recursive_crash2.phpt b/tests/session/session_recursive_crash2.phpt
new file mode 100644
index 0000000..2a32226
--- /dev/null
+++ b/tests/session/session_recursive_crash2.phpt
@@ -0,0 +1,61 @@
1--TEST--
2session user handler recursive crash - issue suhosin#60
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--ENV--
6return <<<END
7HTTP_USER_AGENT=test
8END;
9--INI--
10suhosin.session.encrypt=On
11suhosin.session.cryptkey=D3F4UL7
12suhosin.session.cryptua=On
13suhosin.session.cryptdocroot=Off
14suhosin.session.cryptraddr=0
15suhosin.session.checkraddr=0
16--FILE--
17<?php
18$foo = "";
19
20class MySessionHandlerA implements SessionHandlerInterface
21{
22 public function close() {return TRUE;}
23 public function destroy($session_id) {return TRUE;}
24 public function gc($maxlifetime) {return TRUE;}
25 public function open($save_path, $name) { global $foo; $foo .= "A\n"; return TRUE;}
26 public function read($session_id ) {return TRUE;}
27 public function write($session_id, $session_data) {return TRUE;}
28}
29
30session_set_save_handler(new MySessionHandlerA(), true);
31session_start();
32session_destroy();
33
34//
35
36class MySessionHandlerB extends MySessionHandlerA
37{
38 public function open($save_path, $name) { global $foo; $foo .= "B\n"; return TRUE;}
39}
40
41session_set_save_handler(new MySessionHandlerB(), true);
42session_start();
43session_destroy();
44
45//
46
47class MySessionHandlerC extends MySessionHandlerA
48{
49 public function open($save_path, $name) { global $foo; $foo .= "C\n"; return TRUE;}
50}
51
52session_set_save_handler(new MySessionHandlerC(), true);
53session_start();
54session_destroy();
55
56
57echo $foo;
58--EXPECTF--
59A
60B
61C
diff --git a/tests/session/sessionhandler.inc b/tests/session/sessionhandler.inc
new file mode 100644
index 0000000..b8bc7bd
--- /dev/null
+++ b/tests/session/sessionhandler.inc
@@ -0,0 +1,43 @@
1<?php
2
3
4class GenericSessionHandler implements SessionHandlerInterface
5{
6 function open($savePath, $sessionName) { return true; }
7
8 function close() { return true; }
9
10 function read($id) { return (string)""; }
11
12 function write($id, $data) { return true; }
13
14 function destroy($id) { return true; }
15
16 function gc($maxlifetime) { return true; }
17
18}
19class WriteSessionHandler extends GenericSessionHandler
20{
21 function write($id, $data)
22 {
23 echo "SESSION: $data\n";
24 return true;
25 }
26}
27class RemoteAddrSessionHandler extends GenericSessionHandler
28{
29 ## key empty and REMOTE_ADDR set to 127.0.0.1
30 function read($id) { return (string)"j1YTvIOAUqxZMjuJ_ZnHPHWY5XEayycsr7O94aMzmBQ."; }
31}
32
33
34function session_test_start($handler=null) {
35 if (!$handler) {
36 $handler = new WriteSessionHandler();
37 }
38 session_set_save_handler($handler, true);
39 session_start();
40 return $handler;
41}
42
43?>