mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-26 04:58:21 +09:00
Thomas VincentandTheWitness
ed09adfffd
* Validate graph item fields before they reach the RRDtool command line Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Match textalign validation to the RRD_ALIGN constants Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>
95 lines
4.4 KiB
PHP
95 lines
4.4 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
| |
|
|
| This program is distributed in the hope that it will be useful, |
|
|
| but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
|
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
|
| GNU General Public License for more details. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
| This code is designed, written, and maintained by the Cacti Group. See |
|
|
| about.php and/or the AUTHORS file for specific developer information. |
|
|
+-------------------------------------------------------------------------+
|
|
| http://www.cacti.net/ |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
// Mirror include/global_constants.php so the module can be loaded on its own.
|
|
foreach (['RRD_ALIGN_LEFT' => 'left', 'RRD_ALIGN_RIGHT' => 'right',
|
|
'RRD_ALIGN_JUSTIFIED' => 'justified', 'RRD_ALIGN_CENTER' => 'center'] as $name => $value) {
|
|
if (!defined($name)) {
|
|
define($name, $value);
|
|
}
|
|
}
|
|
|
|
require_once dirname(__DIR__, 2) . '/lib/rrd_graph_item.php';
|
|
|
|
test('alpha accepts a hex pair', function () : void {
|
|
expect(rrd_graph_item_alpha('FF'))->toBe('FF');
|
|
expect(rrd_graph_item_alpha('00'))->toBe('00');
|
|
expect(rrd_graph_item_alpha(' 7f '))->toBe('7f');
|
|
});
|
|
|
|
test('alpha rejects anything that is not two hex digits', function () : void {
|
|
expect(rrd_graph_item_alpha('F'))->toBe('');
|
|
expect(rrd_graph_item_alpha('FFF'))->toBe('');
|
|
expect(rrd_graph_item_alpha('GG'))->toBe('');
|
|
expect(rrd_graph_item_alpha(''))->toBe('');
|
|
expect(rrd_graph_item_alpha(null))->toBe('');
|
|
});
|
|
|
|
test('alpha cannot carry a shell payload', function () : void {
|
|
expect(rrd_graph_item_alpha('FF;id'))->toBe('');
|
|
expect(rrd_graph_item_alpha('`id`'))->toBe('');
|
|
});
|
|
|
|
test('number list accepts one or more numbers', function () : void {
|
|
expect(rrd_graph_item_number_list('5'))->toBe('5');
|
|
expect(rrd_graph_item_number_list('5,10'))->toBe('5,10');
|
|
expect(rrd_graph_item_number_list('1.5,2.25,3'))->toBe('1.5,2.25,3');
|
|
expect(rrd_graph_item_number_list(' 4,8 '))->toBe('4,8');
|
|
});
|
|
|
|
test('number list treats an empty value as unset', function () : void {
|
|
expect(rrd_graph_item_number_list(''))->toBe('');
|
|
expect(rrd_graph_item_number_list(' '))->toBe('');
|
|
expect(rrd_graph_item_number_list(null))->toBe('');
|
|
});
|
|
|
|
test('number list rejects a non numeric part', function () : void {
|
|
expect(rrd_graph_item_number_list('5,abc'))->toBe('');
|
|
expect(rrd_graph_item_number_list('5,'))->toBe('');
|
|
expect(rrd_graph_item_number_list('abc'))->toBe('');
|
|
});
|
|
|
|
test('number list cannot carry a shell payload', function () : void {
|
|
// GHSA-vq9v-6ggh-phhr: dashes is varchar(20) and reached shell_exec unescaped
|
|
expect(rrd_graph_item_number_list('1;touch /tmp/pwn;#'))->toBe('');
|
|
expect(rrd_graph_item_number_list('5,10;id'))->toBe('');
|
|
expect(rrd_graph_item_number_list('$(id)'))->toBe('');
|
|
});
|
|
|
|
test('textalign accepts the RRDtool keywords', function () : void {
|
|
expect(rrd_graph_item_textalign('left'))->toBe('left');
|
|
expect(rrd_graph_item_textalign('right'))->toBe('right');
|
|
expect(rrd_graph_item_textalign('center'))->toBe('center');
|
|
// the editor stores RRD_ALIGN_JUSTIFIED, which is 'justified' not 'justify'
|
|
expect(rrd_graph_item_textalign(' justified '))->toBe('justified');
|
|
});
|
|
|
|
test('textalign rejects anything outside the keyword set', function () : void {
|
|
expect(rrd_graph_item_textalign('LEFT'))->toBe('');
|
|
expect(rrd_graph_item_textalign('justify'))->toBe('');
|
|
expect(rrd_graph_item_textalign('left;id'))->toBe('');
|
|
expect(rrd_graph_item_textalign(''))->toBe('');
|
|
expect(rrd_graph_item_textalign(null))->toBe('');
|
|
});
|