summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--tests/filter/cookie_disallow_nul.phpt32
-rw-r--r--tests/filter/cookie_disallow_ws.phpt31
-rw-r--r--tests/filter/cookie_max_array_depth.phpt66
-rw-r--r--tests/filter/cookie_max_array_index_length.phpt53
-rw-r--r--tests/filter/cookie_max_name_length.phpt43
-rw-r--r--tests/filter/cookie_max_totalname_length.phpt44
-rw-r--r--tests/filter/cookie_max_value_length.phpt35
-rw-r--r--tests/filter/cookie_max_vars.phpt30
-rw-r--r--tests/filter/filter_logging_statistics.phpt43
-rw-r--r--tests/filter/get_allow_ws.phpt56
-rw-r--r--tests/filter/get_disallow_nul.phpt32
-rw-r--r--tests/filter/get_disallow_ws.phpt30
-rw-r--r--tests/filter/get_filter_1.phpt45
-rw-r--r--tests/filter/get_filter_2.phpt36
-rw-r--r--tests/filter/get_globals.phpt24
-rw-r--r--tests/filter/get_max_array_depth.phpt66
-rw-r--r--tests/filter/get_max_array_index_length.phpt53
-rw-r--r--tests/filter/get_max_name_length.phpt43
-rw-r--r--tests/filter/get_max_totalname_length.phpt44
-rw-r--r--tests/filter/get_max_value_length.phpt35
-rw-r--r--tests/filter/input_filter_allow_nul.phptbin0 -> 949 bytes
-rw-r--r--tests/filter/input_filter_request_max_value_length.phpt61
-rw-r--r--tests/filter/post_disallow_nul.phpt32
-rw-r--r--tests/filter/post_disallow_nul_rfc1867.phptbin0 -> 1497 bytes
-rw-r--r--tests/filter/post_disallow_ws.phpt31
-rw-r--r--tests/filter/post_fileupload_array_index_blacklist.phpt44
-rw-r--r--tests/filter/post_fileupload_array_index_whitelist.phpt44
-rw-r--r--tests/filter/post_fileupload_filter_1.phpt118
-rw-r--r--tests/filter/post_fileupload_filter_2.phpt67
-rw-r--r--tests/filter/post_filter_1.phpt45
-rw-r--r--tests/filter/post_filter_2.phpt36
-rw-r--r--tests/filter/post_filter_empty_avar.phpt27
-rw-r--r--tests/filter/post_filter_empty_var.phpt24
-rw-r--r--tests/filter/post_max_array_depth.phpt66
-rw-r--r--tests/filter/post_max_array_depth_rfc1867.phpt91
-rw-r--r--tests/filter/post_max_array_index_length.phpt53
-rw-r--r--tests/filter/post_max_array_index_length_rfc1867.phpt80
-rw-r--r--tests/filter/post_max_name_length.phpt43
-rw-r--r--tests/filter/post_max_name_length_rfc1867.phpt72
-rw-r--r--tests/filter/post_max_totalname_length.phpt44
-rw-r--r--tests/filter/post_max_totalname_length_rfc1867.phpt73
-rw-r--r--tests/filter/post_max_value_length.phpt36
-rw-r--r--tests/filter/post_max_value_length_rfc1867.phptbin0 -> 1895 bytes
-rw-r--r--tests/filter/request_array_index_blacklist.phpt56
-rw-r--r--tests/filter/request_array_index_whitelist.phpt54
-rw-r--r--tests/filter/request_disallow_nul.phpt51
-rw-r--r--tests/filter/request_disallow_ws.phpt30
-rw-r--r--tests/filter/request_max_array_depth.phpt153
-rw-r--r--tests/filter/request_max_array_index_length.phpt114
-rw-r--r--tests/filter/request_max_name_length.phpt85
-rw-r--r--tests/filter/request_max_totalname_length.phpt87
-rw-r--r--tests/filter/server_encode_off.phpt31
-rw-r--r--tests/filter/server_encode_on.phpt30
-rw-r--r--tests/filter/server_filter.phpt36
-rw-r--r--tests/filter/server_strip_off.phpt27
-rw-r--r--tests/filter/server_strip_on.phpt27
-rw-r--r--tests/filter/server_user_agent_strip_off.phpt27
-rw-r--r--tests/filter/server_user_agent_strip_on.phpt27
-rw-r--r--tests/filter/suhosin_upload_disallow_binary_off.phptbin0 -> 9474 bytes
-rw-r--r--tests/filter/suhosin_upload_disallow_binary_on.phptbin0 -> 12264 bytes
-rw-r--r--tests/filter/suhosin_upload_disallow_binary_utf8.phpt46
-rw-r--r--tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt50
-rw-r--r--tests/filter/suhosin_upload_disallow_elf.phpt61
-rw-r--r--tests/filter/suhosin_upload_disallow_elf_off.phpt57
-rw-r--r--tests/filter/suhosin_upload_max_uploads.phpt87
-rw-r--r--tests/filter/suhosin_upload_remove_binary.phptbin0 -> 799 bytes
-rw-r--r--tests/filter/suhosin_upload_remove_binary_utf8.phpt34
-rw-r--r--tests/filter/suhosin_upload_remove_binary_utf8fail.phpt34
68 files changed, 3132 insertions, 0 deletions
diff --git a/tests/filter/cookie_disallow_nul.phpt b/tests/filter/cookie_disallow_nul.phpt
new file mode 100644
index 0000000..fc9975c
--- /dev/null
+++ b/tests/filter/cookie_disallow_nul.phpt
@@ -0,0 +1,32 @@
1--TEST--
2input filter: suhosin.cookie.disallow_nul
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.disallow_nul=0
12suhosin.cookie.disallow_nul=1
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16var1=xx%001;var2=2;var3=xx%003;var4=4;
17--GET--
18--POST--
19--FILE--
20<?php
21var_dump($_COOKIE);
22?>
23--EXPECTF--
24array(2) {
25 ["var2"]=>
26 string(1) "2"
27 ["var4"]=>
28 string(1) "4"
29}
30ALERT - ASCII-NUL chars not allowed within COOKIE variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - ASCII-NUL chars not allowed within COOKIE variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
32ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_disallow_ws.phpt b/tests/filter/cookie_disallow_ws.phpt
new file mode 100644
index 0000000..fa1f1d4
--- /dev/null
+++ b/tests/filter/cookie_disallow_ws.phpt
@@ -0,0 +1,31 @@
1--TEST--
2input filter: suhosin.cookie.disallow_ws
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.cookie.disallow_ws=1
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15+var1=1;var2=2;%20var3=3; var4=4;
16--GET--
17--POST--
18--FILE--
19<?php
20var_dump($_COOKIE);
21?>
22--EXPECTF--
23array(2) {
24 ["var2"]=>
25 string(1) "2"
26 ["var4"]=>
27 string(1) "4"
28}
29ALERT - COOKIE variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
30ALERT - COOKIE variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_array_depth.phpt b/tests/filter/cookie_max_array_depth.phpt
new file mode 100644
index 0000000..64614ef
--- /dev/null
+++ b/tests/filter/cookie_max_array_depth.phpt
@@ -0,0 +1,66 @@
1--TEST--
2input filter: suhosin.cookie.max_array_depth
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_depth=0
12suhosin.cookie.max_array_depth=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16var1[]=1;var2[][]=2;var3[][][]=3;var4[][][][]=4;var5[][][][][]=5;var6[][][][][][]=6;
17--GET--
18--POST--
19--FILE--
20<?php
21var_dump($_COOKIE);
22?>
23--EXPECTF--
24array(4) {
25 ["var1"]=>
26 array(1) {
27 [0]=>
28 string(1) "1"
29 }
30 ["var2"]=>
31 array(1) {
32 [0]=>
33 array(1) {
34 [0]=>
35 string(1) "2"
36 }
37 }
38 ["var3"]=>
39 array(1) {
40 [0]=>
41 array(1) {
42 [0]=>
43 array(1) {
44 [0]=>
45 string(1) "3"
46 }
47 }
48 }
49 ["var4"]=>
50 array(1) {
51 [0]=>
52 array(1) {
53 [0]=>
54 array(1) {
55 [0]=>
56 array(1) {
57 [0]=>
58 string(1) "4"
59 }
60 }
61 }
62 }
63}
64ALERT - configured COOKIE variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
65ALERT - configured COOKIE variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
66ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_array_index_length.phpt b/tests/filter/cookie_max_array_index_length.phpt
new file mode 100644
index 0000000..19eddd1
--- /dev/null
+++ b/tests/filter/cookie_max_array_index_length.phpt
@@ -0,0 +1,53 @@
1--TEST--
2input filter: suhosin.cookie.max_array_index_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_index_length=0
12suhosin.cookie.max_array_index_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16var1[AAA]=1;var2[BBBB]=1;var3[AAA][BBB]=1;var4[AAA][BBBB]=4;var5[AAA][BBB][CCC]=1;var6[AAA][BBBB][CCC]=1;
17--GET--
18--POST--
19--FILE--
20<?php
21var_dump($_COOKIE);
22?>
23--EXPECTF--
24array(3) {
25 ["var1"]=>
26 array(1) {
27 ["AAA"]=>
28 string(1) "1"
29 }
30 ["var3"]=>
31 array(1) {
32 ["AAA"]=>
33 array(1) {
34 ["BBB"]=>
35 string(1) "1"
36 }
37 }
38 ["var5"]=>
39 array(1) {
40 ["AAA"]=>
41 array(1) {
42 ["BBB"]=>
43 array(1) {
44 ["CCC"]=>
45 string(1) "1"
46 }
47 }
48 }
49}
50ALERT - configured COOKIE variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
51ALERT - configured COOKIE variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
52ALERT - configured COOKIE variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
53ALERT - dropped 3 request variables - (0 in GET, 0 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_name_length.phpt b/tests/filter/cookie_max_name_length.phpt
new file mode 100644
index 0000000..04f9537
--- /dev/null
+++ b/tests/filter/cookie_max_name_length.phpt
@@ -0,0 +1,43 @@
1--TEST--
2input filter: suhosin.cookie.max_name_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_varname_length=0
12suhosin.cookie.max_name_length=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
17--GET--
18--POST--
19--FILE--
20<?php
21var_dump($_COOKIE);
22?>
23--EXPECTF--
24array(4) {
25 ["var"]=>
26 string(1) "0"
27 ["var1"]=>
28 string(1) "1"
29 ["var2"]=>
30 array(1) {
31 [0]=>
32 string(1) "2"
33 }
34 ["var3"]=>
35 array(1) {
36 ["xxx"]=>
37 string(1) "3"
38 }
39}
40ALERT - configured COOKIE variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
41ALERT - configured COOKIE variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
42ALERT - configured COOKIE variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - dropped 3 request variables - (0 in GET, 0 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_totalname_length.phpt b/tests/filter/cookie_max_totalname_length.phpt
new file mode 100644
index 0000000..6b9bb76
--- /dev/null
+++ b/tests/filter/cookie_max_totalname_length.phpt
@@ -0,0 +1,44 @@
1--TEST--
2input filter: suhosin.cookie.max_totalname_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_totalname_length=0
12suhosin.cookie.max_totalname_length=7
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
17--GET--
18--POST--
19--FILE--
20<?php
21var_dump($_COOKIE);
22?>
23--EXPECTF--
24array(5) {
25 ["var"]=>
26 string(1) "0"
27 ["var1"]=>
28 string(1) "1"
29 ["var2"]=>
30 array(1) {
31 [0]=>
32 string(1) "2"
33 }
34 ["var04"]=>
35 string(1) "4"
36 ["var05"]=>
37 array(1) {
38 [0]=>
39 string(1) "5"
40 }
41}
42ALERT - configured COOKIE variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - configured COOKIE variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - dropped 2 request variables - (0 in GET, 0 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_value_length.phpt b/tests/filter/cookie_max_value_length.phpt
new file mode 100644
index 0000000..f3d3ba8
--- /dev/null
+++ b/tests/filter/cookie_max_value_length.phpt
@@ -0,0 +1,35 @@
1--TEST--
2input filter: suhosin.cookie.max_value_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_value_length=0
12suhosin.cookie.max_value_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16var1=1;var2=22;var3=333;var4=4444;var5=55%00555;var6=666666;
17--GET--
18--POST--
19--FILE--
20<?php
21var_dump($_COOKIE);
22?>
23--EXPECTF--
24array(3) {
25 ["var1"]=>
26 string(1) "1"
27 ["var2"]=>
28 string(2) "22"
29 ["var3"]=>
30 string(3) "333"
31}
32ALERT - configured COOKIE variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
33ALERT - configured COOKIE variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
34ALERT - configured COOKIE variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
35ALERT - dropped 3 request variables - (0 in GET, 0 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/cookie_max_vars.phpt b/tests/filter/cookie_max_vars.phpt
new file mode 100644
index 0000000..7389adb
--- /dev/null
+++ b/tests/filter/cookie_max_vars.phpt
@@ -0,0 +1,30 @@
1--TEST--
2input filter: suhosin.cookie.max_vars
3--SKIPIF--
4<?php include "../skipif.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.script=0
9suhosin.log.file=255
10suhosin.log.file.time=0
11suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
12auto_append_file={PWD}/suhosintest.$$.log.tmp
13suhosin.cookie.max_vars=3
14--COOKIE--
15a=1; b=2; c=3; d=4
16--FILE--
17<?php
18var_dump($_COOKIE);
19?>
20--EXPECTF--
21array(3) {
22 ["a"]=>
23 string(1) "1"
24 ["b"]=>
25 string(1) "2"
26 ["c"]=>
27 string(1) "3"
28}
29ALERT - configured COOKIE variable limit exceeded - dropped variable 'd' - all further COOKIE variables are dropped (attacker '%s', file '%s')
30ALERT - dropped 1 request variables - (0 in GET, 0 in POST, 1 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/filter_logging_statistics.phpt b/tests/filter/filter_logging_statistics.phpt
new file mode 100644
index 0000000..a4119b3
--- /dev/null
+++ b/tests/filter/filter_logging_statistics.phpt
@@ -0,0 +1,43 @@
1--TEST--
2suhosin variable filter logging statistics
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.get.max_vars=5
12error_reporting=E_ALL
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17A=A&B=B&C=C&D=D&E=E&F=F&G=G&
18--POST--
19--FILE--
20<?php
21$counter++;
22if ($counter < 5) {
23 include __FILE__;
24} else {
25 var_dump($_GET);
26}
27?>
28--EXPECTF--
29Notice: Undefined variable: counter in %s on line 2
30array(5) {
31 ["A"]=>
32 string(1) "A"
33 ["B"]=>
34 string(1) "B"
35 ["C"]=>
36 string(1) "C"
37 ["D"]=>
38 string(1) "D"
39 ["E"]=>
40 string(1) "E"
41}
42ALERT - configured GET variable limit exceeded - dropped variable 'F' - all further GET variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) %s
diff --git a/tests/filter/get_allow_ws.phpt b/tests/filter/get_allow_ws.phpt
new file mode 100644
index 0000000..190e44c
--- /dev/null
+++ b/tests/filter/get_allow_ws.phpt
@@ -0,0 +1,56 @@
1--TEST--
2input filter: allow whitespace
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8suhosin.request.disallow_ws=0
9suhosin.get.disallow_ws=0
10suhosin.post.disallow_ws=0
11suhosin.cookie.disallow_ws=0
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15+var1=1;var2=2;%20var3=3; var4=4;
16--GET--
17+var1=1&var2=2&%20var3=3& var4=4&
18--POST--
19+var1=1&var2=2&%20var3=3& var4=4&
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(4) {
28 ["var1"]=>
29 string(1) "1"
30 ["var2"]=>
31 string(1) "2"
32 ["var3"]=>
33 string(1) "3"
34 ["var4"]=>
35 string(1) "4"
36}
37array(4) {
38 ["var1"]=>
39 string(1) "1"
40 ["var2"]=>
41 string(1) "2"
42 ["var3"]=>
43 string(1) "3"
44 ["var4"]=>
45 string(1) "4"
46}
47array(4) {
48 ["var1"]=>
49 string(1) "1"
50 ["var2"]=>
51 string(1) "2"
52 ["var3"]=>
53 string(1) "3"
54 ["var4"]=>
55 string(1) "4"
56} \ No newline at end of file
diff --git a/tests/filter/get_disallow_nul.phpt b/tests/filter/get_disallow_nul.phpt
new file mode 100644
index 0000000..6432a4e
--- /dev/null
+++ b/tests/filter/get_disallow_nul.phpt
@@ -0,0 +1,32 @@
1--TEST--
2input filter: suhosin.get.disallow_nul
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.disallow_nul=0
12suhosin.get.disallow_nul=1
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17var1=xx%001&var2=2&var3=xx%003&var4=4&
18--POST--
19--FILE--
20<?php
21var_dump($_GET);
22?>
23--EXPECTF--
24array(2) {
25 ["var2"]=>
26 string(1) "2"
27 ["var4"]=>
28 string(1) "4"
29}
30ALERT - ASCII-NUL chars not allowed within GET variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - ASCII-NUL chars not allowed within GET variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
32ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_disallow_ws.phpt b/tests/filter/get_disallow_ws.phpt
new file mode 100644
index 0000000..c7b57de
--- /dev/null
+++ b/tests/filter/get_disallow_ws.phpt
@@ -0,0 +1,30 @@
1--TEST--
2input filter: suhosin.get.disallow_ws
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.get.disallow_ws=1
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15--GET--
16+var1=1&var2=2&%20var3=3& var4=4&
17--POST--
18--FILE--
19<?php
20var_dump($_GET);
21?>
22--EXPECTF--
23array(1) {
24 ["var2"]=>
25 string(1) "2"
26}
27ALERT - GET variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
28ALERT - GET variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
29ALERT - GET variable name begins with disallowed whitespace - dropped variable ' var4' (attacker 'REMOTE_ADDR not set', file '%s')
30ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_filter_1.phpt b/tests/filter/get_filter_1.phpt
new file mode 100644
index 0000000..7bd9cc3
--- /dev/null
+++ b/tests/filter/get_filter_1.phpt
@@ -0,0 +1,45 @@
1--TEST--
2suhosin GET filter (disallowed variable names)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--COOKIE--
14--GET--
15HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA&HTTP_SESSION_VARS=HTTP_SESSION_VARS&harmless1=harmless1&HTTP_SERVER_VARS=HTTP_SERVER_VARS&HTTP_COOKIE_VARS=HTTP_COOKIE_VARS&HTTP_POST_FILES=HTTP_POST_FILES&HTTP_POST_VARS=HTTP_POST_VARS&HTTP_GET_VARS=HTTP_GET_VARS&HTTP_ENV_VARS=HTTP_ENV_VARS&_SESSION=_SESSION&_REQUEST=_REQUEST&GLOBALS=GLOBALS&_COOKIE=_COOKIE&_SERVER=_SERVER&_FILES=_FILES&_POST=_POST&_ENV=_ENV&_GET=_GET&harmless2=harmless2&
16--POST--
17--FILE--
18<?php
19var_dump($_GET);
20?>
21--EXPECTF--
22array(2) {
23 ["harmless1"]=>
24 string(9) "harmless1"
25 ["harmless2"]=>
26 string(9) "harmless2"
27}
28ALERT - tried to register forbidden variable 'HTTP_RAW_POST_DATA' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
29ALERT - tried to register forbidden variable 'HTTP_SESSION_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
30ALERT - tried to register forbidden variable 'HTTP_SERVER_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - tried to register forbidden variable 'HTTP_COOKIE_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
32ALERT - tried to register forbidden variable 'HTTP_POST_FILES' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
33ALERT - tried to register forbidden variable 'HTTP_POST_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
34ALERT - tried to register forbidden variable 'HTTP_GET_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
35ALERT - tried to register forbidden variable 'HTTP_ENV_VARS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
36ALERT - tried to register forbidden variable '_SESSION' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
37ALERT - tried to register forbidden variable '_REQUEST' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
38ALERT - tried to register forbidden variable 'GLOBALS' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
39ALERT - tried to register forbidden variable '_COOKIE' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
40ALERT - tried to register forbidden variable '_SERVER' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
41ALERT - tried to register forbidden variable '_FILES' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
42ALERT - tried to register forbidden variable '_POST' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - tried to register forbidden variable '_ENV' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - tried to register forbidden variable '_GET' through GET variables (attacker 'REMOTE_ADDR not set', file '%s')
45ALERT - dropped 17 request variables - (17 in GET, 0 in POST, 0 in COOKIE) %s
diff --git a/tests/filter/get_filter_2.phpt b/tests/filter/get_filter_2.phpt
new file mode 100644
index 0000000..1e5d04c
--- /dev/null
+++ b/tests/filter/get_filter_2.phpt
@@ -0,0 +1,36 @@
1--TEST--
2suhosin GET filter (suhosin.get.max_vars)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.get.max_vars=5
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15--GET--
16A=A&B=B&C=C&D=D&E=E&F=F&G=G&
17--POST--
18--FILE--
19<?php
20var_dump($_GET);
21?>
22--EXPECTF--
23array(5) {
24 ["A"]=>
25 string(1) "A"
26 ["B"]=>
27 string(1) "B"
28 ["C"]=>
29 string(1) "C"
30 ["D"]=>
31 string(1) "D"
32 ["E"]=>
33 string(1) "E"
34}
35ALERT - configured GET variable limit exceeded - dropped variable 'F' - all further GET variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
36ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) %s
diff --git a/tests/filter/get_globals.phpt b/tests/filter/get_globals.phpt
new file mode 100644
index 0000000..f16991b
--- /dev/null
+++ b/tests/filter/get_globals.phpt
@@ -0,0 +1,24 @@
1--TEST--
2Testing: GLOBALS in GET
3--SKIPIF--
4<?php include "../skipifcli.inc"; ?>
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=255
8suhosin.log.script=255
9suhosin.log.script.name=/tmp/xx
10--GET--
11a=1&b=2&GLOBALS=123&c=3
12--FILE--
13<?php
14 var_dump($_GET['a']);
15 var_dump($_GET['b']);
16 var_dump($_GET['c']);
17 if (!isset($_GET['GLOBALS'])) var_dump(5);
18 else var_dump(0);
19?>
20--EXPECT--
21string(1) "1"
22string(1) "2"
23string(1) "3"
24int(5)
diff --git a/tests/filter/get_max_array_depth.phpt b/tests/filter/get_max_array_depth.phpt
new file mode 100644
index 0000000..2be4af1
--- /dev/null
+++ b/tests/filter/get_max_array_depth.phpt
@@ -0,0 +1,66 @@
1--TEST--
2input filter: suhosin.get.max_array_depth
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_depth=0
12suhosin.get.max_array_depth=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
18--POST--
19--FILE--
20<?php
21var_dump($_GET);
22?>
23--EXPECTF--
24array(4) {
25 ["var1"]=>
26 array(1) {
27 [0]=>
28 string(1) "1"
29 }
30 ["var2"]=>
31 array(1) {
32 [0]=>
33 array(1) {
34 [0]=>
35 string(1) "2"
36 }
37 }
38 ["var3"]=>
39 array(1) {
40 [0]=>
41 array(1) {
42 [0]=>
43 array(1) {
44 [0]=>
45 string(1) "3"
46 }
47 }
48 }
49 ["var4"]=>
50 array(1) {
51 [0]=>
52 array(1) {
53 [0]=>
54 array(1) {
55 [0]=>
56 array(1) {
57 [0]=>
58 string(1) "4"
59 }
60 }
61 }
62 }
63}
64ALERT - configured GET variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
65ALERT - configured GET variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
66ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_array_index_length.phpt b/tests/filter/get_max_array_index_length.phpt
new file mode 100644
index 0000000..65c8d18
--- /dev/null
+++ b/tests/filter/get_max_array_index_length.phpt
@@ -0,0 +1,53 @@
1--TEST--
2input filter: suhosin.get.max_array_index_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_index_length=0
12suhosin.get.max_array_index_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
18--POST--
19--FILE--
20<?php
21var_dump($_GET);
22?>
23--EXPECTF--
24array(3) {
25 ["var1"]=>
26 array(1) {
27 ["AAA"]=>
28 string(1) "1"
29 }
30 ["var3"]=>
31 array(1) {
32 ["AAA"]=>
33 array(1) {
34 ["BBB"]=>
35 string(1) "1"
36 }
37 }
38 ["var5"]=>
39 array(1) {
40 ["AAA"]=>
41 array(1) {
42 ["BBB"]=>
43 array(1) {
44 ["CCC"]=>
45 string(1) "1"
46 }
47 }
48 }
49}
50ALERT - configured GET variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
51ALERT - configured GET variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
52ALERT - configured GET variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
53ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_name_length.phpt b/tests/filter/get_max_name_length.phpt
new file mode 100644
index 0000000..ef2f4a2
--- /dev/null
+++ b/tests/filter/get_max_name_length.phpt
@@ -0,0 +1,43 @@
1--TEST--
2input filter: suhosin.get.max_name_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_varname_length=0
12suhosin.get.max_name_length=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
18--POST--
19--FILE--
20<?php
21var_dump($_GET);
22?>
23--EXPECTF--
24array(4) {
25 ["var"]=>
26 string(1) "0"
27 ["var1"]=>
28 string(1) "1"
29 ["var2"]=>
30 array(1) {
31 [0]=>
32 string(1) "2"
33 }
34 ["var3"]=>
35 array(1) {
36 ["xxx"]=>
37 string(1) "3"
38 }
39}
40ALERT - configured GET variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
41ALERT - configured GET variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
42ALERT - configured GET variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_totalname_length.phpt b/tests/filter/get_max_totalname_length.phpt
new file mode 100644
index 0000000..83c7ffe
--- /dev/null
+++ b/tests/filter/get_max_totalname_length.phpt
@@ -0,0 +1,44 @@
1--TEST--
2input filter: suhosin.get.max_totalname_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_totalname_length=0
12suhosin.get.max_totalname_length=7
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
18--POST--
19--FILE--
20<?php
21var_dump($_GET);
22?>
23--EXPECTF--
24array(5) {
25 ["var"]=>
26 string(1) "0"
27 ["var1"]=>
28 string(1) "1"
29 ["var2"]=>
30 array(1) {
31 [0]=>
32 string(1) "2"
33 }
34 ["var04"]=>
35 string(1) "4"
36 ["var05"]=>
37 array(1) {
38 [0]=>
39 string(1) "5"
40 }
41}
42ALERT - configured GET variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - configured GET variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - dropped 2 request variables - (2 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/get_max_value_length.phpt b/tests/filter/get_max_value_length.phpt
new file mode 100644
index 0000000..a3c4435
--- /dev/null
+++ b/tests/filter/get_max_value_length.phpt
@@ -0,0 +1,35 @@
1--TEST--
2input filter: suhosin.get.max_value_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_value_length=0
12suhosin.get.max_value_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
18--POST--
19--FILE--
20<?php
21var_dump($_GET);
22?>
23--EXPECTF--
24array(3) {
25 ["var1"]=>
26 string(1) "1"
27 ["var2"]=>
28 string(2) "22"
29 ["var3"]=>
30 string(3) "333"
31}
32ALERT - configured GET variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
33ALERT - configured GET variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
34ALERT - configured GET variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
35ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/input_filter_allow_nul.phpt b/tests/filter/input_filter_allow_nul.phpt
new file mode 100644
index 0000000..e33ef67
--- /dev/null
+++ b/tests/filter/input_filter_allow_nul.phpt
Binary files differ
diff --git a/tests/filter/input_filter_request_max_value_length.phpt b/tests/filter/input_filter_request_max_value_length.phpt
new file mode 100644
index 0000000..27b399e
--- /dev/null
+++ b/tests/filter/input_filter_request_max_value_length.phpt
@@ -0,0 +1,61 @@
1--TEST--
2input filter: suhosin.request.max_value_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_value_length=3
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15var1=1;var2=22;var3=333;var4=4444;var5=55%00555;var6=666666;
16--GET--
17var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
18--POST--
19var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(3) {
28 ["var1"]=>
29 string(1) "1"
30 ["var2"]=>
31 string(2) "22"
32 ["var3"]=>
33 string(3) "333"
34}
35array(3) {
36 ["var1"]=>
37 string(1) "1"
38 ["var2"]=>
39 string(2) "22"
40 ["var3"]=>
41 string(3) "333"
42}
43array(3) {
44 ["var1"]=>
45 string(1) "1"
46 ["var2"]=>
47 string(2) "22"
48 ["var3"]=>
49 string(3) "333"
50}
51ALERT - configured request variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
52ALERT - configured request variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
53ALERT - configured request variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
54ALERT - configured request variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
55ALERT - configured request variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
56ALERT - configured request variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
57ALERT - configured request variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
58ALERT - configured request variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
59ALERT - configured request variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
60ALERT - dropped 9 request variables - (3 in GET, 3 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
61
diff --git a/tests/filter/post_disallow_nul.phpt b/tests/filter/post_disallow_nul.phpt
new file mode 100644
index 0000000..395d096
--- /dev/null
+++ b/tests/filter/post_disallow_nul.phpt
@@ -0,0 +1,32 @@
1--TEST--
2input filter: suhosin.post.disallow_nul
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.disallow_nul=0
12suhosin.post.disallow_nul=1
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var1=xx%001&var2=2&var3=xx%003&var4=4&
19--FILE--
20<?php
21var_dump($_POST);
22?>
23--EXPECTF--
24array(2) {
25 ["var2"]=>
26 string(1) "2"
27 ["var4"]=>
28 string(1) "4"
29}
30ALERT - ASCII-NUL chars not allowed within POST variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - ASCII-NUL chars not allowed within POST variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
32ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_disallow_nul_rfc1867.phpt b/tests/filter/post_disallow_nul_rfc1867.phpt
new file mode 100644
index 0000000..887873a
--- /dev/null
+++ b/tests/filter/post_disallow_nul_rfc1867.phpt
Binary files differ
diff --git a/tests/filter/post_disallow_ws.phpt b/tests/filter/post_disallow_ws.phpt
new file mode 100644
index 0000000..f8abbfd
--- /dev/null
+++ b/tests/filter/post_disallow_ws.phpt
@@ -0,0 +1,31 @@
1--TEST--
2input filter: suhosin.post.disallow_ws
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.post.disallow_ws=1
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15--GET--
16--POST--
17+var1=1&var2=2&%20var3=3& var4=4& var5=5&
18--FILE--
19<?php
20var_dump($_POST);
21?>
22--EXPECTF--
23array(1) {
24 ["var2"]=>
25 string(1) "2"
26}
27ALERT - POST variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
28ALERT - POST variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
29ALERT - POST variable name begins with disallowed whitespace - dropped variable ' var4' (attacker 'REMOTE_ADDR not set', file '%s')
30ALERT - POST variable name begins with disallowed whitespace - dropped variable '.var5' (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - dropped 4 request variables - (0 in GET, 4 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_fileupload_array_index_blacklist.phpt b/tests/filter/post_fileupload_array_index_blacklist.phpt
new file mode 100644
index 0000000..384225d
--- /dev/null
+++ b/tests/filter/post_fileupload_array_index_blacklist.phpt
@@ -0,0 +1,44 @@
1--TEST--
2suhosin file upload filter (array index character whitelist)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11file_uploads=1
12suhosin.request.array_index_char_blacklist=ABC
13--SKIPIF--
14<?php include('skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="fn[foo][bar]"
21
22ok
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="fn[foo][BAR]"
25
26bad
27-----------------------------20896060251896012921717172737--
28--FILE--
29<?php
30var_dump($_POST);
31?>
32--EXPECTF--
33array(1) {
34 ["fn"]=>
35 array(1) {
36 ["foo"]=>
37 array(1) {
38 ["bar"]=>
39 string(2) "ok"
40 }
41 }
42}
43ALERT - array index contains blacklisted characters - dropped variable 'fn[foo][BAR]' (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - dropped 1 request variables - (0 in GET, 1 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_fileupload_array_index_whitelist.phpt b/tests/filter/post_fileupload_array_index_whitelist.phpt
new file mode 100644
index 0000000..38a93ab
--- /dev/null
+++ b/tests/filter/post_fileupload_array_index_whitelist.phpt
@@ -0,0 +1,44 @@
1--TEST--
2suhosin file upload filter (array index character whitelist)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11file_uploads=1
12suhosin.request.array_index_char_whitelist=abcdefghijklmnopqrstuvwxyz
13--SKIPIF--
14<?php include('skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="fn[foo][bar]"
21
22ok
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="fn[foo][BAR]"
25
26bad
27-----------------------------20896060251896012921717172737--
28--FILE--
29<?php
30var_dump($_POST);
31?>
32--EXPECTF--
33array(1) {
34 ["fn"]=>
35 array(1) {
36 ["foo"]=>
37 array(1) {
38 ["bar"]=>
39 string(2) "ok"
40 }
41 }
42}
43ALERT - array index contains not whitelisted characters - dropped variable 'fn[foo][BAR]' (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - dropped 1 request variables - (0 in GET, 1 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_fileupload_filter_1.phpt b/tests/filter/post_fileupload_filter_1.phpt
new file mode 100644
index 0000000..401b4be
--- /dev/null
+++ b/tests/filter/post_fileupload_filter_1.phpt
@@ -0,0 +1,118 @@
1--TEST--
2suhosin rfc1867 file upload filter (disallowed variable names)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11file_uploads=1
12upload_max_filesize=1024
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="HTTP_RAW_POST_DATA"
21
22HTTP_RAW_POST_DATA
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="HTTP_SESSION_VARS"
25
26HTTP_SESSION_VARS
27-----------------------------20896060251896012921717172737
28Content-Disposition: form-data; name="HTTP_SERVER_VARS"
29
30HTTP_SERVER_VARS
31-----------------------------20896060251896012921717172737
32Content-Disposition: form-data; name="HTTP_COOKIE_VARS"
33
34HTTP_COOKIE_VARS
35-----------------------------20896060251896012921717172737
36Content-Disposition: form-data; name="HTTP_POST_FILES"
37
38HTTP_POST_FILES
39-----------------------------20896060251896012921717172737
40Content-Disposition: form-data; name="HTTP_POST_VARS"
41
42HTTP_POST_VARS
43-----------------------------20896060251896012921717172737
44Content-Disposition: form-data; name="HTTP_GET_VARS"
45
46HTTP_GET_VARS
47-----------------------------20896060251896012921717172737
48Content-Disposition: form-data; name="HTTP_ENV_VARS"
49
50HTTP_ENV_VARS
51-----------------------------20896060251896012921717172737
52Content-Disposition: form-data; name="_SESSION"
53
54_SESSION
55-----------------------------20896060251896012921717172737
56Content-Disposition: form-data; name="_REQUEST"
57
58_REQUEST
59-----------------------------20896060251896012921717172737
60Content-Disposition: form-data; name="GLOBALS"
61
62GLOBALS
63-----------------------------20896060251896012921717172737
64Content-Disposition: form-data; name="_COOKIE"
65
66_COOKIE
67-----------------------------20896060251896012921717172737
68Content-Disposition: form-data; name="_SERVER"
69
70_SERVER
71-----------------------------20896060251896012921717172737
72Content-Disposition: form-data; name="_FILES"
73
74_FILES
75-----------------------------20896060251896012921717172737
76Content-Disposition: form-data; name="_POST"
77
78_POST
79-----------------------------20896060251896012921717172737
80Content-Disposition: form-data; name="_ENV"
81
82_ENV
83-----------------------------20896060251896012921717172737
84Content-Disposition: form-data; name="_GET"
85
86_GET
87-----------------------------20896060251896012921717172737
88Content-Disposition: form-data; name="harmless"
89
90harmless
91-----------------------------20896060251896012921717172737--
92--FILE--
93<?php
94var_dump($_POST);
95?>
96--EXPECTF--
97array(1) {
98 ["harmless"]=>
99 string(8) "harmless"
100}
101ALERT - tried to register forbidden variable 'HTTP_RAW_POST_DATA' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
102ALERT - tried to register forbidden variable 'HTTP_SESSION_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
103ALERT - tried to register forbidden variable 'HTTP_SERVER_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
104ALERT - tried to register forbidden variable 'HTTP_COOKIE_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
105ALERT - tried to register forbidden variable 'HTTP_POST_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
106ALERT - tried to register forbidden variable 'HTTP_POST_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
107ALERT - tried to register forbidden variable 'HTTP_GET_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
108ALERT - tried to register forbidden variable 'HTTP_ENV_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
109ALERT - tried to register forbidden variable '_SESSION' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
110ALERT - tried to register forbidden variable '_REQUEST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
111ALERT - tried to register forbidden variable 'GLOBALS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
112ALERT - tried to register forbidden variable '_COOKIE' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
113ALERT - tried to register forbidden variable '_SERVER' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
114ALERT - tried to register forbidden variable '_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
115ALERT - tried to register forbidden variable '_POST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
116ALERT - tried to register forbidden variable '_ENV' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
117ALERT - tried to register forbidden variable '_GET' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
118ALERT - dropped 17 request variables - (0 in GET, 17 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s) \ No newline at end of file
diff --git a/tests/filter/post_fileupload_filter_2.phpt b/tests/filter/post_fileupload_filter_2.phpt
new file mode 100644
index 0000000..939b7fc
--- /dev/null
+++ b/tests/filter/post_fileupload_filter_2.phpt
@@ -0,0 +1,67 @@
1--TEST--
2suhosin rfc1867 file upload filter (suhosin.post.max_vars)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.post.max_vars=5
12file_uploads=1
13upload_max_filesize=1024
14--SKIPIF--
15<?php include('../skipif.inc'); ?>
16--COOKIE--
17--GET--
18--POST_RAW--
19Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
20-----------------------------20896060251896012921717172737
21Content-Disposition: form-data; name="A"
22
23A
24-----------------------------20896060251896012921717172737
25Content-Disposition: form-data; name="B"
26
27B
28-----------------------------20896060251896012921717172737
29Content-Disposition: form-data; name="C"
30
31C
32-----------------------------20896060251896012921717172737
33Content-Disposition: form-data; name="D"
34
35D
36-----------------------------20896060251896012921717172737
37Content-Disposition: form-data; name="E"
38
39E
40-----------------------------20896060251896012921717172737
41Content-Disposition: form-data; name="F"
42
43F
44-----------------------------20896060251896012921717172737
45Content-Disposition: form-data; name="G"
46
47G
48-----------------------------20896060251896012921717172737--
49--FILE--
50<?php
51var_dump($_POST);
52?>
53--EXPECTF--
54array(5) {
55 ["A"]=>
56 string(1) "A"
57 ["B"]=>
58 string(1) "B"
59 ["C"]=>
60 string(1) "C"
61 ["D"]=>
62 string(1) "D"
63 ["E"]=>
64 string(1) "E"
65}
66ALERT - configured POST variable limit exceeded - dropped variable 'F' - all further POST variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
67ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_filter_1.phpt b/tests/filter/post_filter_1.phpt
new file mode 100644
index 0000000..16ee164
--- /dev/null
+++ b/tests/filter/post_filter_1.phpt
@@ -0,0 +1,45 @@
1--TEST--
2suhosin POST filter (disallowed variable names)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--COOKIE--
14--GET--
15--POST--
16HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA&HTTP_SESSION_VARS=HTTP_SESSION_VARS&harmless1=harmless1&HTTP_SERVER_VARS=HTTP_SERVER_VARS&HTTP_COOKIE_VARS=HTTP_COOKIE_VARS&HTTP_POST_FILES=HTTP_POST_FILES&HTTP_POST_VARS=HTTP_POST_VARS&HTTP_GET_VARS=HTTP_GET_VARS&HTTP_ENV_VARS=HTTP_ENV_VARS&_SESSION=_SESSION&_REQUEST=_REQUEST&GLOBALS=GLOBALS&_COOKIE=_COOKIE&_SERVER=_SERVER&_FILES=_FILES&_POST=_POST&_ENV=_ENV&_GET=_GET&harmless2=harmless2&
17--FILE--
18<?php
19var_dump($_POST);
20?>
21--EXPECTF--
22array(2) {
23 ["harmless1"]=>
24 string(9) "harmless1"
25 ["harmless2"]=>
26 string(9) "harmless2"
27}
28ALERT - tried to register forbidden variable 'HTTP_RAW_POST_DATA' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
29ALERT - tried to register forbidden variable 'HTTP_SESSION_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
30ALERT - tried to register forbidden variable 'HTTP_SERVER_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
31ALERT - tried to register forbidden variable 'HTTP_COOKIE_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
32ALERT - tried to register forbidden variable 'HTTP_POST_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
33ALERT - tried to register forbidden variable 'HTTP_POST_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
34ALERT - tried to register forbidden variable 'HTTP_GET_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
35ALERT - tried to register forbidden variable 'HTTP_ENV_VARS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
36ALERT - tried to register forbidden variable '_SESSION' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
37ALERT - tried to register forbidden variable '_REQUEST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
38ALERT - tried to register forbidden variable 'GLOBALS' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
39ALERT - tried to register forbidden variable '_COOKIE' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
40ALERT - tried to register forbidden variable '_SERVER' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
41ALERT - tried to register forbidden variable '_FILES' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
42ALERT - tried to register forbidden variable '_POST' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - tried to register forbidden variable '_ENV' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - tried to register forbidden variable '_GET' through POST variables (attacker 'REMOTE_ADDR not set', file '%s')
45ALERT - dropped 17 request variables - (0 in GET, 17 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_filter_2.phpt b/tests/filter/post_filter_2.phpt
new file mode 100644
index 0000000..b70b120
--- /dev/null
+++ b/tests/filter/post_filter_2.phpt
@@ -0,0 +1,36 @@
1--TEST--
2suhosin POST filter (suhosin.post.max_vars)
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.post.max_vars=5
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15--GET--
16--POST--
17A=A&B=B&C=C&D=D&E=E&F=F&G=G&
18--FILE--
19<?php
20var_dump($_POST);
21?>
22--EXPECTF--
23array(5) {
24 ["A"]=>
25 string(1) "A"
26 ["B"]=>
27 string(1) "B"
28 ["C"]=>
29 string(1) "C"
30 ["D"]=>
31 string(1) "D"
32 ["E"]=>
33 string(1) "E"
34}
35ALERT - configured POST variable limit exceeded - dropped variable 'F' - all further POST variables are dropped (attacker 'REMOTE_ADDR not set', file '%s')
36ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_filter_empty_avar.phpt b/tests/filter/post_filter_empty_avar.phpt
new file mode 100644
index 0000000..d09990c
--- /dev/null
+++ b/tests/filter/post_filter_empty_avar.phpt
@@ -0,0 +1,27 @@
1--TEST--
2suhosin POST filter with empty array variable
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8--SKIPIF--
9<?php include('../skipif.inc'); ?>
10--COOKIE--
11--GET--
12--POST--
13a[]=&a[]=test
14--FILE--
15<?php
16var_dump($_POST);
17?>
18--EXPECTF--
19array(1) {
20 ["a"]=>
21 array(2) {
22 [0]=>
23 string(0) ""
24 [1]=>
25 string(4) "test"
26 }
27}
diff --git a/tests/filter/post_filter_empty_var.phpt b/tests/filter/post_filter_empty_var.phpt
new file mode 100644
index 0000000..87866e2
--- /dev/null
+++ b/tests/filter/post_filter_empty_var.phpt
@@ -0,0 +1,24 @@
1--TEST--
2suhosin POST filter with empty variable
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8--SKIPIF--
9<?php include('../skipif.inc'); ?>
10--COOKIE--
11--GET--
12--POST--
13A=&B=test
14--FILE--
15<?php
16var_dump($_POST);
17?>
18--EXPECTF--
19array(2) {
20 ["A"]=>
21 string(0) ""
22 ["B"]=>
23 string(4) "test"
24}
diff --git a/tests/filter/post_max_array_depth.phpt b/tests/filter/post_max_array_depth.phpt
new file mode 100644
index 0000000..70a5ad6
--- /dev/null
+++ b/tests/filter/post_max_array_depth.phpt
@@ -0,0 +1,66 @@
1--TEST--
2input filter: suhosin.post.max_array_depth
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_depth=0
12suhosin.post.max_array_depth=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
19--FILE--
20<?php
21var_dump($_POST);
22?>
23--EXPECTF--
24array(4) {
25 ["var1"]=>
26 array(1) {
27 [0]=>
28 string(1) "1"
29 }
30 ["var2"]=>
31 array(1) {
32 [0]=>
33 array(1) {
34 [0]=>
35 string(1) "2"
36 }
37 }
38 ["var3"]=>
39 array(1) {
40 [0]=>
41 array(1) {
42 [0]=>
43 array(1) {
44 [0]=>
45 string(1) "3"
46 }
47 }
48 }
49 ["var4"]=>
50 array(1) {
51 [0]=>
52 array(1) {
53 [0]=>
54 array(1) {
55 [0]=>
56 array(1) {
57 [0]=>
58 string(1) "4"
59 }
60 }
61 }
62 }
63}
64ALERT - configured POST variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
65ALERT - configured POST variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
66ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_array_depth_rfc1867.phpt b/tests/filter/post_max_array_depth_rfc1867.phpt
new file mode 100644
index 0000000..925878b
--- /dev/null
+++ b/tests/filter/post_max_array_depth_rfc1867.phpt
@@ -0,0 +1,91 @@
1--TEST--
2input filter: suhosin.post.max_array_depth - RFC1867 version
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_depth=0
12suhosin.post.max_array_depth=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="var1[]"
21
221
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="var2[][]"
25
262
27-----------------------------20896060251896012921717172737
28Content-Disposition: form-data; name="var3[][][]"
29
303
31-----------------------------20896060251896012921717172737
32Content-Disposition: form-data; name="var4[][][][]"
33
344
35-----------------------------20896060251896012921717172737
36Content-Disposition: form-data; name="var5[][][][][]"
37
385
39-----------------------------20896060251896012921717172737
40Content-Disposition: form-data; name="var6[][][][][][]"
41
426
43-----------------------------20896060251896012921717172737--
44--FILE--
45<?php
46var_dump($_POST);
47?>
48--EXPECTF--
49array(4) {
50 ["var1"]=>
51 array(1) {
52 [0]=>
53 string(1) "1"
54 }
55 ["var2"]=>
56 array(1) {
57 [0]=>
58 array(1) {
59 [0]=>
60 string(1) "2"
61 }
62 }
63 ["var3"]=>
64 array(1) {
65 [0]=>
66 array(1) {
67 [0]=>
68 array(1) {
69 [0]=>
70 string(1) "3"
71 }
72 }
73 }
74 ["var4"]=>
75 array(1) {
76 [0]=>
77 array(1) {
78 [0]=>
79 array(1) {
80 [0]=>
81 array(1) {
82 [0]=>
83 string(1) "4"
84 }
85 }
86 }
87 }
88}
89ALERT - configured POST variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
90ALERT - configured POST variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
91ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_array_index_length.phpt b/tests/filter/post_max_array_index_length.phpt
new file mode 100644
index 0000000..9f8404c
--- /dev/null
+++ b/tests/filter/post_max_array_index_length.phpt
@@ -0,0 +1,53 @@
1--TEST--
2input filter: suhosin.post.max_array_index_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_index_length=0
12suhosin.post.max_array_index_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
19--FILE--
20<?php
21var_dump($_POST);
22?>
23--EXPECTF--
24array(3) {
25 ["var1"]=>
26 array(1) {
27 ["AAA"]=>
28 string(1) "1"
29 }
30 ["var3"]=>
31 array(1) {
32 ["AAA"]=>
33 array(1) {
34 ["BBB"]=>
35 string(1) "1"
36 }
37 }
38 ["var5"]=>
39 array(1) {
40 ["AAA"]=>
41 array(1) {
42 ["BBB"]=>
43 array(1) {
44 ["CCC"]=>
45 string(1) "1"
46 }
47 }
48 }
49}
50ALERT - configured POST variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
51ALERT - configured POST variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
52ALERT - configured POST variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
53ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_array_index_length_rfc1867.phpt b/tests/filter/post_max_array_index_length_rfc1867.phpt
new file mode 100644
index 0000000..22591f2
--- /dev/null
+++ b/tests/filter/post_max_array_index_length_rfc1867.phpt
@@ -0,0 +1,80 @@
1--TEST--
2input filter: suhosin.post.max_array_index_length - RFC1867 version
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_index_length=0
12suhosin.post.max_array_index_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
19--POST_RAW--
20Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
21-----------------------------20896060251896012921717172737
22Content-Disposition: form-data; name="var1[AAA]"
23
241
25-----------------------------20896060251896012921717172737
26Content-Disposition: form-data; name="var2[BBBB]"
27
281
29-----------------------------20896060251896012921717172737
30Content-Disposition: form-data; name="var3[AAA][BBB]"
31
321
33-----------------------------20896060251896012921717172737
34Content-Disposition: form-data; name="var4[AAA][BBBB]"
35
361
37-----------------------------20896060251896012921717172737
38Content-Disposition: form-data; name="var5[AAA][BBB][CCC]"
39
401
41-----------------------------20896060251896012921717172737
42Content-Disposition: form-data; name="var6[AAA][BBBB][CCC]"
43
441
45-----------------------------20896060251896012921717172737--
46--FILE--
47<?php
48var_dump($_POST);
49?>
50--EXPECTF--
51array(3) {
52 ["var1"]=>
53 array(1) {
54 ["AAA"]=>
55 string(1) "1"
56 }
57 ["var3"]=>
58 array(1) {
59 ["AAA"]=>
60 array(1) {
61 ["BBB"]=>
62 string(1) "1"
63 }
64 }
65 ["var5"]=>
66 array(1) {
67 ["AAA"]=>
68 array(1) {
69 ["BBB"]=>
70 array(1) {
71 ["CCC"]=>
72 string(1) "1"
73 }
74 }
75 }
76}
77ALERT - configured POST variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
78ALERT - configured POST variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
79ALERT - configured POST variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
80ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s) \ No newline at end of file
diff --git a/tests/filter/post_max_name_length.phpt b/tests/filter/post_max_name_length.phpt
new file mode 100644
index 0000000..701356e
--- /dev/null
+++ b/tests/filter/post_max_name_length.phpt
@@ -0,0 +1,43 @@
1--TEST--
2input filter: suhosin.post.max_name_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_varname_length=0
12suhosin.post.max_name_length=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
19--FILE--
20<?php
21var_dump($_POST);
22?>
23--EXPECTF--
24array(4) {
25 ["var"]=>
26 string(1) "0"
27 ["var1"]=>
28 string(1) "1"
29 ["var2"]=>
30 array(1) {
31 [0]=>
32 string(1) "2"
33 }
34 ["var3"]=>
35 array(1) {
36 ["xxx"]=>
37 string(1) "3"
38 }
39}
40ALERT - configured POST variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
41ALERT - configured POST variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
42ALERT - configured POST variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_name_length_rfc1867.phpt b/tests/filter/post_max_name_length_rfc1867.phpt
new file mode 100644
index 0000000..0316f17
--- /dev/null
+++ b/tests/filter/post_max_name_length_rfc1867.phpt
@@ -0,0 +1,72 @@
1--TEST--
2input filter: suhosin.post.max_name_length - RFC1867 version
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_varname_length=0
12suhosin.post.max_name_length=4
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="var"
21
220
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="var1"
25
261
27-----------------------------20896060251896012921717172737
28Content-Disposition: form-data; name="var2[]"
29
302
31-----------------------------20896060251896012921717172737
32Content-Disposition: form-data; name="var3[xxx]"
33
343
35-----------------------------20896060251896012921717172737
36Content-Disposition: form-data; name="var04"
37
384
39-----------------------------20896060251896012921717172737
40Content-Disposition: form-data; name="var05[]"
41
425
43-----------------------------20896060251896012921717172737
44Content-Disposition: form-data; name="var06[xxx]"
45
466
47-----------------------------20896060251896012921717172737--
48--FILE--
49<?php
50var_dump($_POST);
51?>
52--EXPECTF--
53array(4) {
54 ["var"]=>
55 string(1) "0"
56 ["var1"]=>
57 string(1) "1"
58 ["var2"]=>
59 array(1) {
60 [0]=>
61 string(1) "2"
62 }
63 ["var3"]=>
64 array(1) {
65 ["xxx"]=>
66 string(1) "3"
67 }
68}
69ALERT - configured POST variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
70ALERT - configured POST variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
71ALERT - configured POST variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
72ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_totalname_length.phpt b/tests/filter/post_max_totalname_length.phpt
new file mode 100644
index 0000000..eb6cfb5
--- /dev/null
+++ b/tests/filter/post_max_totalname_length.phpt
@@ -0,0 +1,44 @@
1--TEST--
2input filter: suhosin.post.max_totalname_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_totalname_length=0
12suhosin.post.max_totalname_length=7
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
19--FILE--
20<?php
21var_dump($_POST);
22?>
23--EXPECTF--
24array(5) {
25 ["var"]=>
26 string(1) "0"
27 ["var1"]=>
28 string(1) "1"
29 ["var2"]=>
30 array(1) {
31 [0]=>
32 string(1) "2"
33 }
34 ["var04"]=>
35 string(1) "4"
36 ["var05"]=>
37 array(1) {
38 [0]=>
39 string(1) "5"
40 }
41}
42ALERT - configured POST variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
43ALERT - configured POST variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
44ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_totalname_length_rfc1867.phpt b/tests/filter/post_max_totalname_length_rfc1867.phpt
new file mode 100644
index 0000000..efcface
--- /dev/null
+++ b/tests/filter/post_max_totalname_length_rfc1867.phpt
@@ -0,0 +1,73 @@
1--TEST--
2input filter: suhosin.post.max_totalname_length - RFC1867 version
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_totalname_length=0
12suhosin.post.max_totalname_length=7
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="var"
21
220
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="var1"
25
261
27-----------------------------20896060251896012921717172737
28Content-Disposition: form-data; name="var2[]"
29
302
31-----------------------------20896060251896012921717172737
32Content-Disposition: form-data; name="var3[xxx]"
33
343
35-----------------------------20896060251896012921717172737
36Content-Disposition: form-data; name="var04"
37
384
39-----------------------------20896060251896012921717172737
40Content-Disposition: form-data; name="var05[]"
41
425
43-----------------------------20896060251896012921717172737
44Content-Disposition: form-data; name="var06[xxx]"
45
466
47-----------------------------20896060251896012921717172737--
48--FILE--
49<?php
50var_dump($_POST);
51?>
52--EXPECTF--
53array(5) {
54 ["var"]=>
55 string(1) "0"
56 ["var1"]=>
57 string(1) "1"
58 ["var2"]=>
59 array(1) {
60 [0]=>
61 string(1) "2"
62 }
63 ["var04"]=>
64 string(1) "4"
65 ["var05"]=>
66 array(1) {
67 [0]=>
68 string(1) "5"
69 }
70}
71ALERT - configured POST variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
72ALERT - configured POST variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
73ALERT - dropped 2 request variables - (0 in GET, 2 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/post_max_value_length.phpt b/tests/filter/post_max_value_length.phpt
new file mode 100644
index 0000000..cd5da3b
--- /dev/null
+++ b/tests/filter/post_max_value_length.phpt
@@ -0,0 +1,36 @@
1--TEST--
2input filter: suhosin.post.max_value_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_value_length=0
12suhosin.post.max_value_length=3
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST--
18var1=1&var2=22&var3=333&var4=4444&var5=55%00555&var6=666666&
19--FILE--
20<?php
21var_dump($_POST);
22?>
23--EXPECTF--
24array(3) {
25 ["var1"]=>
26 string(1) "1"
27 ["var2"]=>
28 string(2) "22"
29 ["var3"]=>
30 string(3) "333"
31}
32ALERT - configured POST variable value length limit exceeded - dropped variable 'var4' (attacker 'REMOTE_ADDR not set', file '%s')
33ALERT - configured POST variable value length limit exceeded - dropped variable 'var5' (attacker 'REMOTE_ADDR not set', file '%s')
34ALERT - configured POST variable value length limit exceeded - dropped variable 'var6' (attacker 'REMOTE_ADDR not set', file '%s')
35ALERT - dropped 3 request variables - (0 in GET, 3 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
36
diff --git a/tests/filter/post_max_value_length_rfc1867.phpt b/tests/filter/post_max_value_length_rfc1867.phpt
new file mode 100644
index 0000000..6d807f4
--- /dev/null
+++ b/tests/filter/post_max_value_length_rfc1867.phpt
Binary files differ
diff --git a/tests/filter/request_array_index_blacklist.phpt b/tests/filter/request_array_index_blacklist.phpt
new file mode 100644
index 0000000..f8037ee
--- /dev/null
+++ b/tests/filter/request_array_index_blacklist.phpt
@@ -0,0 +1,56 @@
1--TEST--
2input filter: suhosin.request.array_index_blacklist
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.array_index_char_blacklist="=ABC%{}\\$;"
12--SKIPIF--
13<?php include('skipif.inc'); ?>
14--COOKIE--
15var1[aaa]=1;var2[bbB]=1;var3[ccc][ccC]=1
16--GET--
17var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
18--POST--
19var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
20--FILE--
21<?php
22var_dump(ini_get("suhosin.request.array_index_char_blacklist"));
23var_dump($_GET);
24var_dump($_POST);
25var_dump($_COOKIE);
26?>
27--EXPECTF--
28string(10) "=ABC%{}\$;"
29array(1) {
30 ["var1"]=>
31 array(1) {
32 ["aaa"]=>
33 string(1) "1"
34 }
35}
36array(1) {
37 ["var1"]=>
38 array(1) {
39 ["aaa"]=>
40 string(1) "1"
41 }
42}
43array(1) {
44 ["var1"]=>
45 array(1) {
46 ["aaa"]=>
47 string(1) "1"
48 }
49}
50ALERT - array index contains blacklisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
51ALERT - array index contains blacklisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
52ALERT - array index contains blacklisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
53ALERT - array index contains blacklisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
54ALERT - array index contains blacklisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
55ALERT - array index contains blacklisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
56ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/request_array_index_whitelist.phpt b/tests/filter/request_array_index_whitelist.phpt
new file mode 100644
index 0000000..eeb3ffa
--- /dev/null
+++ b/tests/filter/request_array_index_whitelist.phpt
@@ -0,0 +1,54 @@
1--TEST--
2input filter: suhosin.request.array_index_whitelist
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.array_index_char_whitelist=abcdefghijklmnopqrstuvwxyz
12--SKIPIF--
13<?php include('skipif.inc'); ?>
14--COOKIE--
15var1[aaa]=1;var2[bbB]=1;var3[ccc][ccC]=1
16--GET--
17var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
18--POST--
19var1[aaa]=1&var2[bbB]=1&var3[ccc][ccC]=1
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(1) {
28 ["var1"]=>
29 array(1) {
30 ["aaa"]=>
31 string(1) "1"
32 }
33}
34array(1) {
35 ["var1"]=>
36 array(1) {
37 ["aaa"]=>
38 string(1) "1"
39 }
40}
41array(1) {
42 ["var1"]=>
43 array(1) {
44 ["aaa"]=>
45 string(1) "1"
46 }
47}
48ALERT - array index contains not whitelisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
49ALERT - array index contains not whitelisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
50ALERT - array index contains not whitelisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
51ALERT - array index contains not whitelisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
52ALERT - array index contains not whitelisted characters - dropped variable 'var2[bbB]' (attacker 'REMOTE_ADDR not set', file '%s')
53ALERT - array index contains not whitelisted characters - dropped variable 'var3[ccc][ccC]' (attacker 'REMOTE_ADDR not set', file '%s')
54ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/request_disallow_nul.phpt b/tests/filter/request_disallow_nul.phpt
new file mode 100644
index 0000000..621eda7
--- /dev/null
+++ b/tests/filter/request_disallow_nul.phpt
@@ -0,0 +1,51 @@
1--TEST--
2input filter: suhosin.request.disallow_nul
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.disallow_nul=1
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15var1=xx%001;var2=2;var3=xx%003;var4=4;
16--GET--
17var1=xx%001&var2=2&var3=xx%003&var4=4&
18--POST--
19var1=xx%001&var2=2&var3=xx%003&var4=4&
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(2) {
28 ["var2"]=>
29 string(1) "2"
30 ["var4"]=>
31 string(1) "4"
32}
33array(2) {
34 ["var2"]=>
35 string(1) "2"
36 ["var4"]=>
37 string(1) "4"
38}
39array(2) {
40 ["var2"]=>
41 string(1) "2"
42 ["var4"]=>
43 string(1) "4"
44}
45ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
46ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
47ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
48ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
49ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var1' (attacker 'REMOTE_ADDR not set', file '%s')
50ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'var3' (attacker 'REMOTE_ADDR not set', file '%s')
51ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', file %s)
diff --git a/tests/filter/request_disallow_ws.phpt b/tests/filter/request_disallow_ws.phpt
new file mode 100644
index 0000000..99041b8
--- /dev/null
+++ b/tests/filter/request_disallow_ws.phpt
@@ -0,0 +1,30 @@
1--TEST--
2input filter: suhosin.request.disallow_ws
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.disallow_ws=1
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15--GET--
16+var1=1&var2=2&%20var3=3& var4=4&
17--POST--
18--FILE--
19<?php
20var_dump($_GET);
21?>
22--EXPECTF--
23array(1) {
24 ["var2"]=>
25 string(1) "2"
26}
27ALERT - request variable name begins with disallowed whitespace - dropped variable ' var1' (attacker 'REMOTE_ADDR not set', file '%s')
28ALERT - request variable name begins with disallowed whitespace - dropped variable ' var3' (attacker 'REMOTE_ADDR not set', file '%s')
29ALERT - request variable name begins with disallowed whitespace - dropped variable ' var4' (attacker 'REMOTE_ADDR not set', file '%s')
30ALERT - dropped 3 request variables - (3 in GET, 0 in POST, 0 in COOKIE) (attacker 'REMOTE_ADDR not set', file %s)
diff --git a/tests/filter/request_max_array_depth.phpt b/tests/filter/request_max_array_depth.phpt
new file mode 100644
index 0000000..7782a4c
--- /dev/null
+++ b/tests/filter/request_max_array_depth.phpt
@@ -0,0 +1,153 @@
1--TEST--
2input filter: suhosin.request.max_array_depth
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_depth=4
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15var1[]=1;var2[][]=2;var3[][][]=3;var4[][][][]=4;var5[][][][][]=5;var6[][][][][][]=6;
16--GET--
17var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
18--POST--
19var1[]=1&var2[][]=2&var3[][][]=3&var4[][][][]=4&var5[][][][][]=5&var6[][][][][][]=6&
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(4) {
28 ["var1"]=>
29 array(1) {
30 [0]=>
31 string(1) "1"
32 }
33 ["var2"]=>
34 array(1) {
35 [0]=>
36 array(1) {
37 [0]=>
38 string(1) "2"
39 }
40 }
41 ["var3"]=>
42 array(1) {
43 [0]=>
44 array(1) {
45 [0]=>
46 array(1) {
47 [0]=>
48 string(1) "3"
49 }
50 }
51 }
52 ["var4"]=>
53 array(1) {
54 [0]=>
55 array(1) {
56 [0]=>
57 array(1) {
58 [0]=>
59 array(1) {
60 [0]=>
61 string(1) "4"
62 }
63 }
64 }
65 }
66}
67array(4) {
68 ["var1"]=>
69 array(1) {
70 [0]=>
71 string(1) "1"
72 }
73 ["var2"]=>
74 array(1) {
75 [0]=>
76 array(1) {
77 [0]=>
78 string(1) "2"
79 }
80 }
81 ["var3"]=>
82 array(1) {
83 [0]=>
84 array(1) {
85 [0]=>
86 array(1) {
87 [0]=>
88 string(1) "3"
89 }
90 }
91 }
92 ["var4"]=>
93 array(1) {
94 [0]=>
95 array(1) {
96 [0]=>
97 array(1) {
98 [0]=>
99 array(1) {
100 [0]=>
101 string(1) "4"
102 }
103 }
104 }
105 }
106}
107array(4) {
108 ["var1"]=>
109 array(1) {
110 [0]=>
111 string(1) "1"
112 }
113 ["var2"]=>
114 array(1) {
115 [0]=>
116 array(1) {
117 [0]=>
118 string(1) "2"
119 }
120 }
121 ["var3"]=>
122 array(1) {
123 [0]=>
124 array(1) {
125 [0]=>
126 array(1) {
127 [0]=>
128 string(1) "3"
129 }
130 }
131 }
132 ["var4"]=>
133 array(1) {
134 [0]=>
135 array(1) {
136 [0]=>
137 array(1) {
138 [0]=>
139 array(1) {
140 [0]=>
141 string(1) "4"
142 }
143 }
144 }
145 }
146}
147ALERT - configured request variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
148ALERT - configured request variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
149ALERT - configured request variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
150ALERT - configured request variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
151ALERT - configured request variable array depth limit exceeded - dropped variable 'var5[][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
152ALERT - configured request variable array depth limit exceeded - dropped variable 'var6[][][][][][]' (attacker 'REMOTE_ADDR not set', file '%s')
153ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/request_max_array_index_length.phpt b/tests/filter/request_max_array_index_length.phpt
new file mode 100644
index 0000000..eefa501
--- /dev/null
+++ b/tests/filter/request_max_array_index_length.phpt
@@ -0,0 +1,114 @@
1--TEST--
2input filter: suhosin.request.max_array_index_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_array_index_length=3
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15var1[AAA]=1;var2[BBBB]=1;var3[AAA][BBB]=1;var4[AAA][BBBB]=4;var5[AAA][BBB][CCC]=1;var6[AAA][BBBB][CCC]=1;
16--GET--
17var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
18--POST--
19var1[AAA]=1&var2[BBBB]=1&var3[AAA][BBB]=1&var4[AAA][BBBB]=4&var5[AAA][BBB][CCC]=1&var6[AAA][BBBB][CCC]=1
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(3) {
28 ["var1"]=>
29 array(1) {
30 ["AAA"]=>
31 string(1) "1"
32 }
33 ["var3"]=>
34 array(1) {
35 ["AAA"]=>
36 array(1) {
37 ["BBB"]=>
38 string(1) "1"
39 }
40 }
41 ["var5"]=>
42 array(1) {
43 ["AAA"]=>
44 array(1) {
45 ["BBB"]=>
46 array(1) {
47 ["CCC"]=>
48 string(1) "1"
49 }
50 }
51 }
52}
53array(3) {
54 ["var1"]=>
55 array(1) {
56 ["AAA"]=>
57 string(1) "1"
58 }
59 ["var3"]=>
60 array(1) {
61 ["AAA"]=>
62 array(1) {
63 ["BBB"]=>
64 string(1) "1"
65 }
66 }
67 ["var5"]=>
68 array(1) {
69 ["AAA"]=>
70 array(1) {
71 ["BBB"]=>
72 array(1) {
73 ["CCC"]=>
74 string(1) "1"
75 }
76 }
77 }
78}
79array(3) {
80 ["var1"]=>
81 array(1) {
82 ["AAA"]=>
83 string(1) "1"
84 }
85 ["var3"]=>
86 array(1) {
87 ["AAA"]=>
88 array(1) {
89 ["BBB"]=>
90 string(1) "1"
91 }
92 }
93 ["var5"]=>
94 array(1) {
95 ["AAA"]=>
96 array(1) {
97 ["BBB"]=>
98 array(1) {
99 ["CCC"]=>
100 string(1) "1"
101 }
102 }
103 }
104}
105ALERT - configured request variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
106ALERT - configured request variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
107ALERT - configured request variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
108ALERT - configured request variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
109ALERT - configured request variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
110ALERT - configured request variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
111ALERT - configured request variable array index length limit exceeded - dropped variable 'var2[BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
112ALERT - configured request variable array index length limit exceeded - dropped variable 'var4[AAA][BBBB]' (attacker 'REMOTE_ADDR not set', file '%s')
113ALERT - configured request variable array index length limit exceeded - dropped variable 'var6[AAA][BBBB][CCC]' (attacker 'REMOTE_ADDR not set', file '%s')
114ALERT - dropped 9 request variables - (3 in GET, 3 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s) \ No newline at end of file
diff --git a/tests/filter/request_max_name_length.phpt b/tests/filter/request_max_name_length.phpt
new file mode 100644
index 0000000..34f7915
--- /dev/null
+++ b/tests/filter/request_max_name_length.phpt
@@ -0,0 +1,85 @@
1--TEST--
2input filter: suhosin.request.max_varname_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_varname_length=4
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
16--GET--
17var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
18--POST--
19var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(4) {
28 ["var"]=>
29 string(1) "0"
30 ["var1"]=>
31 string(1) "1"
32 ["var2"]=>
33 array(1) {
34 [0]=>
35 string(1) "2"
36 }
37 ["var3"]=>
38 array(1) {
39 ["xxx"]=>
40 string(1) "3"
41 }
42}
43array(4) {
44 ["var"]=>
45 string(1) "0"
46 ["var1"]=>
47 string(1) "1"
48 ["var2"]=>
49 array(1) {
50 [0]=>
51 string(1) "2"
52 }
53 ["var3"]=>
54 array(1) {
55 ["xxx"]=>
56 string(1) "3"
57 }
58}
59array(4) {
60 ["var"]=>
61 string(1) "0"
62 ["var1"]=>
63 string(1) "1"
64 ["var2"]=>
65 array(1) {
66 [0]=>
67 string(1) "2"
68 }
69 ["var3"]=>
70 array(1) {
71 ["xxx"]=>
72 string(1) "3"
73 }
74}
75ALERT - configured request variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
76ALERT - configured request variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
77ALERT - configured request variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
78ALERT - configured request variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
79ALERT - configured request variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
80ALERT - configured request variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
81ALERT - configured request variable name length limit exceeded - dropped variable 'var04' (attacker 'REMOTE_ADDR not set', file '%s')
82ALERT - configured request variable name length limit exceeded - dropped variable 'var05[]' (attacker 'REMOTE_ADDR not set', file '%s')
83ALERT - configured request variable name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
84ALERT - dropped 9 request variables - (3 in GET, 3 in POST, 3 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
85
diff --git a/tests/filter/request_max_totalname_length.phpt b/tests/filter/request_max_totalname_length.phpt
new file mode 100644
index 0000000..c4a415f
--- /dev/null
+++ b/tests/filter/request_max_totalname_length.phpt
@@ -0,0 +1,87 @@
1--TEST--
2input filter: suhosin.request.max_totalname_length
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.request.max_totalname_length=7
12--SKIPIF--
13<?php include('../skipif.inc'); ?>
14--COOKIE--
15var=0;var1=1;var2[]=2;var3[xxx]=3;var04=4;var05[]=5;var06[xxx]=6;
16--GET--
17var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
18--POST--
19var=0&var1=1&var2[]=2&var3[xxx]=3&var04=4&var05[]=5&var06[xxx]=6&
20--FILE--
21<?php
22var_dump($_GET);
23var_dump($_POST);
24var_dump($_COOKIE);
25?>
26--EXPECTF--
27array(5) {
28 ["var"]=>
29 string(1) "0"
30 ["var1"]=>
31 string(1) "1"
32 ["var2"]=>
33 array(1) {
34 [0]=>
35 string(1) "2"
36 }
37 ["var04"]=>
38 string(1) "4"
39 ["var05"]=>
40 array(1) {
41 [0]=>
42 string(1) "5"
43 }
44}
45array(5) {
46 ["var"]=>
47 string(1) "0"
48 ["var1"]=>
49 string(1) "1"
50 ["var2"]=>
51 array(1) {
52 [0]=>
53 string(1) "2"
54 }
55 ["var04"]=>
56 string(1) "4"
57 ["var05"]=>
58 array(1) {
59 [0]=>
60 string(1) "5"
61 }
62}
63array(5) {
64 ["var"]=>
65 string(1) "0"
66 ["var1"]=>
67 string(1) "1"
68 ["var2"]=>
69 array(1) {
70 [0]=>
71 string(1) "2"
72 }
73 ["var04"]=>
74 string(1) "4"
75 ["var05"]=>
76 array(1) {
77 [0]=>
78 string(1) "5"
79 }
80}
81ALERT - configured request variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
82ALERT - configured request variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
83ALERT - configured request variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
84ALERT - configured request variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
85ALERT - configured request variable total name length limit exceeded - dropped variable 'var3[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
86ALERT - configured request variable total name length limit exceeded - dropped variable 'var06[xxx]' (attacker 'REMOTE_ADDR not set', file '%s')
87ALERT - dropped 6 request variables - (2 in GET, 2 in POST, 2 in COOKIE) (attacker 'REMOTE_ADDR not set', %s)
diff --git a/tests/filter/server_encode_off.phpt b/tests/filter/server_encode_off.phpt
new file mode 100644
index 0000000..69793fd
--- /dev/null
+++ b/tests/filter/server_encode_off.phpt
@@ -0,0 +1,31 @@
1--TEST--
2Testing: suhosin.server.encode=Off
3--DESCRIPTION--
4This test is incomplete but at the moment we cannot do better with the standard test framework.
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.server.encode=Off
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15REQUEST_URI=AAA<>"'`!AAA
16END;
17--COOKIE--
18--GET--
19BBB<>"'`!BBB
20--POST--
21--FILE--
22<?php
23// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
24var_dump($_SERVER['REQUEST_URI']);
25var_dump($_SERVER['QUERY_STRING']);
26?>
27--EXPECTF--
28string(12) "AAA<>"'`!AAA"
29string(12) "BBB<>"'`!BBB"
30
31
diff --git a/tests/filter/server_encode_on.phpt b/tests/filter/server_encode_on.phpt
new file mode 100644
index 0000000..3b02ce4
--- /dev/null
+++ b/tests/filter/server_encode_on.phpt
@@ -0,0 +1,30 @@
1--TEST--
2Testing: suhosin.server.encode=On
3--DESCRIPTION--
4This test is incomplete but at the moment we cannot do better with the standard test framework.
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.server.encode=On
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15REQUEST_URI=AAA<>"'`!AAA
16END;
17--COOKIE--
18--GET--
19BBB<>"'`!BBB
20--POST--
21--FILE--
22<?php
23// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
24var_dump($_SERVER['REQUEST_URI']);
25var_dump($_SERVER['QUERY_STRING']);
26?>
27--EXPECTF--
28string(22) "AAA%3C%3E%22%27%60!AAA"
29string(22) "BBB%3C%3E%22%27%60!BBB"
30
diff --git a/tests/filter/server_filter.phpt b/tests/filter/server_filter.phpt
new file mode 100644
index 0000000..f2afdf7
--- /dev/null
+++ b/tests/filter/server_filter.phpt
@@ -0,0 +1,36 @@
1--TEST--
2suhosin SERVER filter
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15HTTP_POST_VARS=HTTP_POST_VARS
16HTTP_MY_VARS=HTTP_MY_VARS
17HTTP_GET_VARS=HTTP_GET_VARS
18HTTP_ENV_VARS=HTTP_ENV_VARS
19HTTP_SERVER_VARS=HTTP_SERVER_VARS
20HTTP_SESSION_VARS=HTTP_SESSION_VARS
21HTTP_COOKIE_VARS=HTTP_COOKIE_VARS
22HTTP_RAW_POST_DATA=HTTP_RAW_POST_DATA
23HTTP_POST_FILES=HTTP_POST_FILES
24END;
25--COOKIE--
26--GET--
27--POST--
28--FILE--
29<?php
30foreach ($_SERVER as $k => $v) {
31 if (!strncmp($k, "HTTP_", 5)) echo "$k => $v\n";
32}
33?>
34--EXPECTF--
35HTTP_MY_VARS => HTTP_MY_VARS
36ALERT - Attacker tried to overwrite a superglobal through a HTTP header (attacker 'REMOTE_ADDR not set', file '%s') \ No newline at end of file
diff --git a/tests/filter/server_strip_off.phpt b/tests/filter/server_strip_off.phpt
new file mode 100644
index 0000000..57b2e97
--- /dev/null
+++ b/tests/filter/server_strip_off.phpt
@@ -0,0 +1,27 @@
1--TEST--
2Testing: suhosin.server.strip=Off
3--DESCRIPTION--
4This test is incomplete but at the moment we cannot do better with the standard test framework.
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.server.strip=Off
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15SCRIPT_NAME=X/index.php/THIS_IS_A_FAKE_NAME<>"'`!AAA
16END;
17--COOKIE--
18--GET--
19A=B
20--POST--
21--FILE--
22<?php
23// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
24var_dump($_SERVER['PHP_SELF']);
25?>
26--EXPECTF--
27string(40) "X/index.php/THIS_IS_A_FAKE_NAME<>"'`!AAA"
diff --git a/tests/filter/server_strip_on.phpt b/tests/filter/server_strip_on.phpt
new file mode 100644
index 0000000..9e9d991
--- /dev/null
+++ b/tests/filter/server_strip_on.phpt
@@ -0,0 +1,27 @@
1--TEST--
2Testing: suhosin.server.strip=On
3--DESCRIPTION--
4This test is incomplete but at the moment we cannot do better with the standard test framework.
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.server.strip=On
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15SCRIPT_NAME=X/index.php/THIS_IS_A_FAKE_NAME<>"'`!AAA
16END;
17--COOKIE--
18--GET--
19A=B
20--POST--
21--FILE--
22<?php
23// THIS TEST IS INCOMPLETE!!! SEE DESCRIPTION
24var_dump($_SERVER['PHP_SELF']);
25?>
26--EXPECTF--
27string(40) "X/index.php/THIS_IS_A_FAKE_NAME?????!AAA"
diff --git a/tests/filter/server_user_agent_strip_off.phpt b/tests/filter/server_user_agent_strip_off.phpt
new file mode 100644
index 0000000..1f58007
--- /dev/null
+++ b/tests/filter/server_user_agent_strip_off.phpt
@@ -0,0 +1,27 @@
1--TEST--
2Testing: suhosin.server.strip=On
3--DESCRIPTION--
4This test is not exactly what we want, but good enough due to limitations of the test framework.
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.server.strip=Off
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15HTTP_USER_AGENT=Mozilla/5.0 (Windows NT 6.0; rv:29.0) <script>alert('123');</script>Gecko/20100101 Firefox/29.0
16END;
17--COOKIE--
18--GET--
19A=B
20--POST--
21--FILE--
22<?php
23var_dump($_SERVER['HTTP_USER_AGENT']);
24?>
25--EXPECTF--
26string(95) "Mozilla/5.0 (Windows NT 6.0; rv:29.0) <script>alert('123');</script>Gecko/20100101 Firefox/29.0"
27
diff --git a/tests/filter/server_user_agent_strip_on.phpt b/tests/filter/server_user_agent_strip_on.phpt
new file mode 100644
index 0000000..df1d040
--- /dev/null
+++ b/tests/filter/server_user_agent_strip_on.phpt
@@ -0,0 +1,27 @@
1--TEST--
2Testing: suhosin.server.strip=On
3--DESCRIPTION--
4This test is not exactly what we want, but good enough due to limitations of the test framework.
5--INI--
6suhosin.log.syslog=0
7suhosin.log.sapi=0
8suhosin.log.stdout=255
9suhosin.log.script=0
10suhosin.server.strip=On
11--SKIPIF--
12<?php include('../skipif.inc'); ?>
13--ENV--
14return <<<END
15HTTP_USER_AGENT=Mozilla/5.0 (Windows NT 6.0; rv:29.0) <script>alert('123');</script>Gecko/20100101 Firefox/29.0
16END;
17--COOKIE--
18--GET--
19A=B
20--POST--
21--FILE--
22<?php
23var_dump($_SERVER['HTTP_USER_AGENT']);
24?>
25--EXPECTF--
26string(95) "Mozilla/5.0 (Windows NT 6.0; rv:29.0) ?script?alert(?123?);?/script?Gecko/20100101 Firefox/29.0"
27
diff --git a/tests/filter/suhosin_upload_disallow_binary_off.phpt b/tests/filter/suhosin_upload_disallow_binary_off.phpt
new file mode 100644
index 0000000..bcb76be
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_off.phpt
Binary files differ
diff --git a/tests/filter/suhosin_upload_disallow_binary_on.phpt b/tests/filter/suhosin_upload_disallow_binary_on.phpt
new file mode 100644
index 0000000..bc2c7ea
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_on.phpt
Binary files differ
diff --git a/tests/filter/suhosin_upload_disallow_binary_utf8.phpt b/tests/filter/suhosin_upload_disallow_binary_utf8.phpt
new file mode 100644
index 0000000..d14f041
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_utf8.phpt
@@ -0,0 +1,46 @@
1--TEST--
2Testing: suhosin.upload.disallow_binary=On with UTF-8
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8file_uploads=1
9suhosin.upload.disallow_binary=On
10suhosin.upload.allow_utf8=On
11max_file_uploads=40
12suhosin.upload.max_uploads=40
13--SKIPIF--
14<?php include('../skipif.inc');
15if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
16?>
17--COOKIE--
18--GET--
19--POST_RAW--
20Content-Type: multipart/form-data; boundary=bound
21--bound
22Content-Disposition: form-data; name="test"; filename="test"
23
24Spaß am Gerät!
25
26--bound--
27--FILE--
28<?php
29var_dump($_FILES);
30?>
31--EXPECTF--
32array(1) {
33 ["test"]=>
34 array(5) {
35 ["name"]=>
36 string(4) "test"
37 ["type"]=>
38 string(0) ""
39 ["tmp_name"]=>
40 string(%d) "%s"
41 ["error"]=>
42 int(0)
43 ["size"]=>
44 int(17)
45 }
46}
diff --git a/tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt b/tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt
new file mode 100644
index 0000000..95e4864
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_binary_utf8fail.phpt
@@ -0,0 +1,50 @@
1--TEST--
2Testing: suhosin.upload.disallow_binary=On with UTF-8 and allow_utf8=Off
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11file_uploads=1
12suhosin.upload.disallow_binary=On
13suhosin.upload.allow_utf8=Off
14max_file_uploads=40
15suhosin.upload.max_uploads=40
16--SKIPIF--
17<?php include('../skipif.inc');
18if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
19?>
20--COOKIE--
21--GET--
22--POST_RAW--
23Content-Type: multipart/form-data; boundary=bound
24--bound
25Content-Disposition: form-data; name="test"; filename="test"
26
27Spaß am Gerät!
28
29--bound--
30--FILE--
31<?php
32var_dump($_FILES);
33?>
34--EXPECTF--
35array(1) {
36 ["test"]=>
37 array(5) {
38 ["name"]=>
39 string(4) "test"
40 ["type"]=>
41 string(0) ""
42 ["tmp_name"]=>
43 string(0) ""
44 ["error"]=>
45 int(8)
46 ["size"]=>
47 int(0)
48 }
49}
50ALERT - uploaded file contains binary data - file dropped (attacker 'REMOTE_ADDR not set', file '%s')
diff --git a/tests/filter/suhosin_upload_disallow_elf.phpt b/tests/filter/suhosin_upload_disallow_elf.phpt
new file mode 100644
index 0000000..7b074f7
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_elf.phpt
@@ -0,0 +1,61 @@
1--TEST--
2Testing: suhosin.upload.disallow_elf=On
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11file_uploads=1
12suhosin.upload.disallow_elf=On
13--SKIPIF--
14<?php include('../skipif.inc'); ?>
15--COOKIE--
16--GET--
17--POST_RAW--
18Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
19-----------------------------20896060251896012921717172737
20Content-Disposition: form-data; name="A"; filename="A"
21
22ELFABCDEFGHIJKLMN
23-----------------------------20896060251896012921717172737
24Content-Disposition: form-data; name="B"; filename="B"
25
26XELFABCDEFGHIJKLMN
27-----------------------------20896060251896012921717172737--
28--FILE--
29<?php
30var_dump($_FILES);
31?>
32--EXPECTF--
33array(2) {
34 ["A"]=>
35 array(5) {
36 ["name"]=>
37 string(1) "A"
38 ["type"]=>
39 string(0) ""
40 ["tmp_name"]=>
41 string(0) ""
42 ["error"]=>
43 int(8)
44 ["size"]=>
45 int(0)
46 }
47 ["B"]=>
48 array(5) {
49 ["name"]=>
50 string(1) "B"
51 ["type"]=>
52 string(0) ""
53 ["tmp_name"]=>
54 string(%d) "%s"
55 ["error"]=>
56 int(0)
57 ["size"]=>
58 int(18)
59 }
60}
61ALERT - uploaded file is an ELF executable - file dropped (attacker 'REMOTE_ADDR not set', file '%s') \ No newline at end of file
diff --git a/tests/filter/suhosin_upload_disallow_elf_off.phpt b/tests/filter/suhosin_upload_disallow_elf_off.phpt
new file mode 100644
index 0000000..832692c
--- /dev/null
+++ b/tests/filter/suhosin_upload_disallow_elf_off.phpt
@@ -0,0 +1,57 @@
1--TEST--
2Testing: suhosin.upload.disallow_elf=Off
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8file_uploads=1
9suhosin.upload.disallow_elf=Off
10--SKIPIF--
11<?php include('../skipif.inc'); ?>
12--COOKIE--
13--GET--
14--POST_RAW--
15Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
16-----------------------------20896060251896012921717172737
17Content-Disposition: form-data; name="A"; filename="A"
18
19ELFABCDEFGHIJKLMN
20-----------------------------20896060251896012921717172737
21Content-Disposition: form-data; name="B"; filename="B"
22
23XELFABCDEFGHIJKLMN
24-----------------------------20896060251896012921717172737--
25--FILE--
26<?php
27var_dump($_FILES);
28?>
29--EXPECTF--
30array(2) {
31 ["A"]=>
32 array(5) {
33 ["name"]=>
34 string(1) "A"
35 ["type"]=>
36 string(0) ""
37 ["tmp_name"]=>
38 string(%d) "%s"
39 ["error"]=>
40 int(0)
41 ["size"]=>
42 int(18)
43 }
44 ["B"]=>
45 array(5) {
46 ["name"]=>
47 string(1) "B"
48 ["type"]=>
49 string(0) ""
50 ["tmp_name"]=>
51 string(%d) "%s"
52 ["error"]=>
53 int(0)
54 ["size"]=>
55 int(18)
56 }
57} \ No newline at end of file
diff --git a/tests/filter/suhosin_upload_max_uploads.phpt b/tests/filter/suhosin_upload_max_uploads.phpt
new file mode 100644
index 0000000..fb6f249
--- /dev/null
+++ b/tests/filter/suhosin_upload_max_uploads.phpt
@@ -0,0 +1,87 @@
1--TEST--
2suhosin.upload.max_uploads
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.script=0
7suhosin.log.file=255
8suhosin.log.file.time=0
9suhosin.log.file.name={PWD}/suhosintest.$$.log.tmp
10auto_append_file={PWD}/suhosintest.$$.log.tmp
11suhosin.post.max_vars=5
12file_uploads=1
13suhosin.upload.max_uploads=3
14--SKIPIF--
15<?php include('../skipif.inc'); ?>
16--COOKIE--
17--GET--
18--POST_RAW--
19Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
20-----------------------------20896060251896012921717172737
21Content-Disposition: form-data; name="A"; filename="A"
22
23A
24-----------------------------20896060251896012921717172737
25Content-Disposition: form-data; name="B"; filename="B"
26
27B
28-----------------------------20896060251896012921717172737
29Content-Disposition: form-data; name="C"; filename="C"
30
31C
32-----------------------------20896060251896012921717172737
33Content-Disposition: form-data; name="D"; filename="D"
34
35D
36-----------------------------20896060251896012921717172737
37Content-Disposition: form-data; name="E"; filename="E"
38
39E
40-----------------------------20896060251896012921717172737--
41--FILE--
42<?php
43var_dump($_FILES);
44?>
45--EXPECTF--
46array(3) {
47 ["A"]=>
48 array(5) {
49 ["name"]=>
50 string(1) "A"
51 ["type"]=>
52 string(0) ""
53 ["tmp_name"]=>
54 string(%d) "%s"
55 ["error"]=>
56 int(0)
57 ["size"]=>
58 int(1)
59 }
60 ["B"]=>
61 array(5) {
62 ["name"]=>
63 string(1) "B"
64 ["type"]=>
65 string(0) ""
66 ["tmp_name"]=>
67 string(%d) "%s"
68 ["error"]=>
69 int(0)
70 ["size"]=>
71 int(1)
72 }
73 ["C"]=>
74 array(5) {
75 ["name"]=>
76 string(1) "C"
77 ["type"]=>
78 string(0) ""
79 ["tmp_name"]=>
80 string(%d) "%s"
81 ["error"]=>
82 int(0)
83 ["size"]=>
84 int(1)
85 }
86}
87ALERT - configured fileupload limit exceeded - file dropped (attacker 'REMOTE_ADDR not set', file '%s') \ No newline at end of file
diff --git a/tests/filter/suhosin_upload_remove_binary.phpt b/tests/filter/suhosin_upload_remove_binary.phpt
new file mode 100644
index 0000000..8d158c3
--- /dev/null
+++ b/tests/filter/suhosin_upload_remove_binary.phpt
Binary files differ
diff --git a/tests/filter/suhosin_upload_remove_binary_utf8.phpt b/tests/filter/suhosin_upload_remove_binary_utf8.phpt
new file mode 100644
index 0000000..564c095
--- /dev/null
+++ b/tests/filter/suhosin_upload_remove_binary_utf8.phpt
@@ -0,0 +1,34 @@
1--TEST--
2Testing: suhosin.upload.remove_binary=On with UTF-8
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8file_uploads=1
9suhosin.upload.disallow_binary=Off
10suhosin.upload.remove_binary=On
11suhosin.upload.allow_utf8=On
12max_file_uploads=40
13suhosin.upload.max_uploads=40
14--SKIPIF--
15<?php include('../skipif.inc');
16if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
17?>
18--COOKIE--
19--GET--
20--POST_RAW--
21Content-Type: multipart/form-data; boundary=bound
22--bound
23Content-Disposition: form-data; name="test"; filename="test"
24
25Spaß am Gerät!
26
27--bound--
28--FILE--
29<?php
30var_dump(file_get_contents($_FILES['test']['tmp_name']));
31?>
32--EXPECTF--
33string(17) "Spaß am Gerät!
34" \ No newline at end of file
diff --git a/tests/filter/suhosin_upload_remove_binary_utf8fail.phpt b/tests/filter/suhosin_upload_remove_binary_utf8fail.phpt
new file mode 100644
index 0000000..4787a3a
--- /dev/null
+++ b/tests/filter/suhosin_upload_remove_binary_utf8fail.phpt
@@ -0,0 +1,34 @@
1--TEST--
2Testing: suhosin.upload.remove_binary=On with UTF-8 and allow_utf8=Off
3--INI--
4suhosin.log.syslog=0
5suhosin.log.sapi=0
6suhosin.log.stdout=255
7suhosin.log.script=0
8file_uploads=1
9suhosin.upload.disallow_binary=Off
10suhosin.upload.remove_binary=On
11suhosin.upload.allow_utf8=Off
12max_file_uploads=40
13suhosin.upload.max_uploads=40
14--SKIPIF--
15<?php include('../skipif.inc');
16if (ini_get('suhosin.upload.allow_utf8') === FALSE) { die("skip feature not compiled in"); }
17?>
18--COOKIE--
19--GET--
20--POST_RAW--
21Content-Type: multipart/form-data; boundary=bound
22--bound
23Content-Disposition: form-data; name="test"; filename="test"
24
25Spaß am Gerät!
26
27--bound--
28--FILE--
29<?php
30var_dump(file_get_contents($_FILES['test']['tmp_name']));
31?>
32--EXPECTF--
33string(13) "Spa am Gert!
34" \ No newline at end of file