20 files changed, 326 insertions, 0 deletions

diff --git a/src/tests/eval_blacklist/config/eval_backlist.ini b/src/tests/eval_blacklist/config/eval_backlist.ini
new file mode 100644
index 0000000..b181598
--- /dev/null
+++ b/src/tests/eval_blacklist/config/eval_backlist.ini
@@ -0,0 +1 @@
+sp.eval_blacklist.list("strlen");
diff --git a/src/tests/eval_blacklist/config/eval_backlist_list.ini b/src/tests/eval_blacklist/config/eval_backlist_list.ini
new file mode 100644
index 0000000..b395d03
--- /dev/null
+++ b/src/tests/eval_blacklist/config/eval_backlist_list.ini
@@ -0,0 +1 @@
+sp.eval_blacklist.list("strcmp,strlen");
diff --git a/src/tests/eval_blacklist/config/eval_backlist_simulation.ini b/src/tests/eval_blacklist/config/eval_backlist_simulation.ini
new file mode 100644
index 0000000..2d8dc73
--- /dev/null
+++ b/src/tests/eval_blacklist/config/eval_backlist_simulation.ini
@@ -0,0 +1 @@
+sp.eval_blacklist.list("strlen").simulation();
diff --git a/src/tests/eval_blacklist/config/eval_whitelist.ini b/src/tests/eval_blacklist/config/eval_whitelist.ini
new file mode 100644
index 0000000..7a8f6ef
--- /dev/null
+++ b/src/tests/eval_blacklist/config/eval_whitelist.ini
@@ -0,0 +1 @@
+sp.eval_whitelist.list("my_fun,cos");
diff --git a/src/tests/eval_blacklist/config/eval_whitelist_blacklist.ini b/src/tests/eval_blacklist/config/eval_whitelist_blacklist.ini
new file mode 100644
index 0000000..4e7bc8e
--- /dev/null
+++ b/src/tests/eval_blacklist/config/eval_whitelist_blacklist.ini
@@ -0,0 +1,2 @@
+sp.eval_blacklist.list("my_fun,cos,tan");
+sp.eval_whitelist.list("my_fun,tan");
diff --git a/src/tests/eval_blacklist/config/eval_whitelist_simulation.ini b/src/tests/eval_blacklist/config/eval_whitelist_simulation.ini
new file mode 100644
index 0000000..9d94db3
--- /dev/null
+++ b/src/tests/eval_blacklist/config/eval_whitelist_simulation.ini
@@ -0,0 +1 @@
+sp.eval_whitelist.list("my_fun,cos").simulation();
diff --git a/src/tests/eval_blacklist/eval_backlist.phpt b/src/tests/eval_blacklist/eval_backlist.phpt
new file mode 100644
index 0000000..f24af96
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Eval blacklist
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist.ini
+--FILE--
+<?php 
+$a = strlen("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval('$a = strlen("1234");');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 14
+
+Fatal error: [snuffleupagus][eval] A call to strlen was tried in eval, in %a/eval_backlist.php:1, dropping it. in %a/eval_backlist.php(4) : eval()'d code on line 1
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_backlist_call_user_func.phpt b/src/tests/eval_blacklist/eval_backlist_call_user_func.phpt
new file mode 100644
index 0000000..47e8d71
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist_call_user_func.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Eval blacklist - with several calls in an eval.
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist.ini
+--FILE--
+<?php 
+eval('
+        call_user_func("strlen", 2);
+')
+?>
+--EXPECTF--
+Fatal error: [snuffleupagus][eval] A call to strlen was tried in eval, in %s/eval_backlist_call_user_func.php:%d, dropping it. in %s/eval_backlist_call_user_func.php(%d) : eval()'d code on line %d
diff --git a/src/tests/eval_blacklist/eval_backlist_chained.phpt b/src/tests/eval_blacklist/eval_backlist_chained.phpt
new file mode 100644
index 0000000..2360e06
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist_chained.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Eval blacklist - with several calls in an eval.
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist.ini
+--FILE--
+<?php 
+eval('
+        cos(1);
+        strlen(2);
+        sin(3);
+')
+?>
+--EXPECTF--
+Fatal error: [snuffleupagus][eval] A call to strlen was tried in eval, in %s/eval_backlist_chained.php:%d, dropping it. in %s/eval_backlist_chained.php(%d) : eval()'d code on line %d
diff --git a/src/tests/eval_blacklist/eval_backlist_list.phpt b/src/tests/eval_blacklist/eval_backlist_list.phpt
new file mode 100644
index 0000000..5bf0ea8
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist_list.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Eval blacklist - with a list of functions
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist_list.ini
+--FILE--
+<?php 
+$a = strlen("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval('$a = strlen("1234");');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 14
+
+Fatal error: [snuffleupagus][eval] A call to strlen was tried in eval, in %a/eval_backlist_list.php:1, dropping it. in %a/eval_backlist_list.php(4) : eval()'d code on line 1
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_backlist_simulation.phpt b/src/tests/eval_blacklist/eval_backlist_simulation.phpt
new file mode 100644
index 0000000..3089c2d
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist_simulation.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Eval blacklist simulation
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist_simulation.ini
+--FILE--
+<?php 
+$a = strlen("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval('$a = strlen("1234");');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 14
+
+Warning: [snuffleupagus][eval] A call to strlen was tried in eval, in %a/eval_backlist_simulation.php:1, logging it. in %a/eval_backlist_simulation.php(4) : eval()'d code on line 1
+After eval: 4
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_backlist_whitelist.phpt b/src/tests/eval_blacklist/eval_backlist_whitelist.phpt
new file mode 100644
index 0000000..e5650b2
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist_whitelist.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Eval whitelist
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist_blacklist.ini
+--FILE--
+<?php 
+function my_fun($p) {
+        return "my_fun: $p";
+}
+
+$a = my_fun("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval('$a = my_fun("1234");');
+echo "After allowed eval: $a\n";
+eval('$a = cos(1234);');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: my_fun: 1337 1337 1337
+After allowed eval: my_fun: 1234
+
+Fatal error: [snuffleupagus][Eval_whitelist] The function 'cos' isn't in the eval whitelist, dropping its call. in %a/eval_backlist_whitelist.php(10) : eval()'d code on line 1
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_backlist_whitelist_builtin.phpt b/src/tests/eval_blacklist/eval_backlist_whitelist_builtin.phpt
new file mode 100644
index 0000000..2f8bc19
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_backlist_whitelist_builtin.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Eval whitelist/blacklist, on builtin functions
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist_blacklist.ini
+--FILE--
+<?php 
+function my_fun($p) {
+        return "my_fun: $p";
+}
+
+$a = tan(1);
+echo "Outside of eval: $a\n";
+eval('$a = tan(1);');
+echo "After allowed eval: $a\n";
+eval('$a = cos(1234);');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 1.5574077246549
+After allowed eval: 1.5574077246549
+
+Fatal error: [snuffleupagus][Eval_whitelist] The function 'cos' isn't in the eval whitelist, dropping its call. in %a/eval_backlist_whitelist_builtin.php(10) : eval()'d code on line 1
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_whitelist.phpt b/src/tests/eval_blacklist/eval_whitelist.phpt
new file mode 100644
index 0000000..a602d0d
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_whitelist.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Eval whitelist
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist.ini
+--FILE--
+<?php 
+function my_fun($p) {
+        return "my_fun: $p";
+}
+
+function my_other_fun($p) {
+        return "my_other_fun: $p";
+}
+
+$a = my_fun("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval('$a = my_fun("1234");');
+echo "After allowed eval: $a\n";
+eval('$a = my_other_fun("1234");');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: my_fun: 1337 1337 1337
+After allowed eval: my_fun: 1234
+
+Fatal error: [snuffleupagus][Eval_whitelist] The function 'my_other_fun' isn't in the eval whitelist, dropping its call. in %a/eval_whitelist.php on line 7
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_whitelist_builtin.phpt b/src/tests/eval_blacklist/eval_whitelist_builtin.phpt
new file mode 100644
index 0000000..5ed383d
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_whitelist_builtin.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Eval whitelist - builtin function
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist.ini
+--FILE--
+<?php 
+$a = cos(1);
+echo "Outside of eval: $a\n";
+eval('$a = cos(5);');
+echo "After allowed eval: $a\n";
+eval('$a = sin(4);');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 0.54030230586814
+After allowed eval: 0.28366218546323
+
+Fatal error: [snuffleupagus][Eval_whitelist] The function 'sin' isn't in the eval whitelist, dropping its call. in %a/eval_whitelist_builtin.php(6) : eval()'d code on line 1
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_whitelist_include_then_user.phpt b/src/tests/eval_blacklist/eval_whitelist_include_then_user.phpt
new file mode 100644
index 0000000..5ff3bff
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_whitelist_include_then_user.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Eval whitelist - builtin function
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist.ini
+--FILE--
+<?php 
+$b = 1337;
+$dir = __DIR__;
+
+file_put_contents($dir . '/test.bla', '<?php $b = sin(1) ?>');
+
+$a = cos(1);
+echo "Outside of eval: $a\n";
+eval('$a = cos(5);');
+echo "After allowed eval: $a\n";
+eval("include_once('$dir' . '/test.bla');");
+echo "After eval: $b\n";
+?>
+--CLEAN--
+<?php
+$dir = __DIR__;
+unlink($dir . '/test.bla');
+?>
+--EXPECTF--
+Outside of eval: 0.54030230586814
+After allowed eval: 0.28366218546323
+
+Fatal error: [snuffleupagus][Eval_whitelist] The function 'sin' isn't in the eval whitelist, dropping its call. in %a/test.bla on line 1
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_whitelist_simulation.phpt b/src/tests/eval_blacklist/eval_whitelist_simulation.phpt
new file mode 100644
index 0000000..c4a3efa
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_whitelist_simulation.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Eval whitelist simulation
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist_simulation.ini
+--FILE--
+<?php 
+function my_fun($p) {
+        return "my_fun: $p";
+}
+
+function my_other_fun($p) {
+        return "my_other_fun: $p";
+}
+
+$a = my_fun("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval('$a = my_fun("1234");');
+echo "After allowed eval: $a\n";
+eval('$a = my_other_fun("1234");');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: my_fun: 1337 1337 1337
+After allowed eval: my_fun: 1234
+
+Warning: [snuffleupagus][Eval_whitelist] The function 'my_other_fun' isn't in the eval whitelist, logging its call. in %a/eval_whitelist_simulation.php on line 7
+After eval: my_other_fun: 1234
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/eval_whitelist_user_then_builtin.phpt b/src/tests/eval_blacklist/eval_whitelist_user_then_builtin.phpt
new file mode 100644
index 0000000..dbc7d93
--- /dev/null
+++ b/src/tests/eval_blacklist/eval_whitelist_user_then_builtin.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Eval whitelist - builtin function
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_whitelist.ini
+--FILE--
+<?php 
+
+function my_fun() {
+        return sin(10);
+}
+
+$a = my_fun(1);
+echo "Outside of eval: $a\n";
+eval('$a = my_fun(5);');
+echo "After allowed eval: $a\n";
+eval('$a = my_fun(4);');
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: -0.54402111088937
+
+Fatal error: [snuffleupagus][Eval_whitelist] The function 'sin' isn't in the eval whitelist, dropping its call. in %a/eval_whitelist_user_then_builtin.php on line 4
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/nested_eval_blacklist.phpt b/src/tests/eval_blacklist/nested_eval_blacklist.phpt
new file mode 100644
index 0000000..9671a65
--- /dev/null
+++ b/src/tests/eval_blacklist/nested_eval_blacklist.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Eval blacklist - nested eval
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist.ini
+--FILE--
+<?php 
+$a = strlen("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval(
+        "echo 'Inception lvl 1...\n';
+   eval(
+     'echo \"Inception lvl 2...\n\";
+      eval(
+                                 \"echo \'Inception lvl 3...\n\';
+          strlen(\'Limbo!\');
+       \");
+   ');
+");
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 14
+Inception lvl 1...
+Inception lvl 2...
+Inception lvl 3...
+
+Fatal error: [snuffleupagus][eval] A call to strlen was tried in eval, in %a/nested_eval_blacklist.php(5) : eval()'d code(4) : eval()'d code:3, dropping it. in %a/nested_eval_blacklist.php(5) : eval()'d code(4) : eval()'d code(4) : eval()'d code on line 3
\ No newline at end of file
diff --git a/src/tests/eval_blacklist/nested_eval_blacklist2.phpt b/src/tests/eval_blacklist/nested_eval_blacklist2.phpt
new file mode 100644
index 0000000..aee41db
--- /dev/null
+++ b/src/tests/eval_blacklist/nested_eval_blacklist2.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Eval blacklist - nested eval, with a twist
+--SKIPIF--
+<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
+--INI--
+sp.configuration_file={PWD}/config/eval_backlist.ini
+--FILE--
+<?php 
+$a = strlen("1337 1337 1337");
+echo "Outside of eval: $a\n";
+eval(
+        "echo 'Inception lvl 1...\n';
+   eval(
+     'echo \"Inception lvl 2...\n\";
+      eval(
+                                 \"echo \'Inception lvl 3...\n\';
+       \");
+                         strlen(\'Limbo!\');
+   ');
+");
+echo "After eval: $a\n";
+?>
+--EXPECTF--
+Outside of eval: 14
+Inception lvl 1...
+Inception lvl 2...
+Inception lvl 3...
+
+Fatal error: [snuffleupagus][eval] A call to strlen was tried in eval, in %a/nested_eval_blacklist2.php(5) : eval()'d code:7, dropping it. in %a/nested_eval_blacklist2.php(5) : eval()'d code(4) : eval()'d code on line 7
\ No newline at end of file