mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-03 02:27:13 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
39 lines
1.5 KiB
PHP
39 lines
1.5 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* Path and RRD hardening: the imported data-query xml_path is confined to the
|
|
* Cacti tree (GHSA-m67r), rrdtool_create_error_image routes the theme through
|
|
* the allowlist (GHSA-mpfm), path_dsstats_log is escaped before the dsstats
|
|
* shell redirect (GHSA-pjq5), and the data_templates rrd_maximum/rrd_minimum
|
|
* validator is anchored (GHSA-wp33).
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
test('imported data-query xml_path is confined to the Cacti tree (GHSA-m67r)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/import.php');
|
|
expect($s)->toContain('realpath(CACTI_PATH_BASE)')
|
|
->and($s)->toContain('$lexically_contained');
|
|
});
|
|
|
|
test('rrdtool_create_error_image validates the theme (GHSA-mpfm)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/rrd.php');
|
|
expect($s)->toContain('cacti_validate_theme(get_selected_theme())');
|
|
});
|
|
|
|
test('path_dsstats_log is escaped before the shell redirect (GHSA-pjq5)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/dsstats.php');
|
|
expect($s)->toContain(">> ' . cacti_escapeshellarg");
|
|
});
|
|
|
|
test('data_templates rrd_maximum/rrd_minimum validator is anchored (GHSA-wp33)', function () use ($root) {
|
|
$s = file_get_contents($root . '/data_templates.php');
|
|
expect($s)->toContain("'rrd_maximum', [new Assert")
|
|
->and($s)->toContain('\z/');
|
|
});
|