mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-29 08:06:58 +09:00
Sean Mancini
96033267cb
* refactor(tests): reorganize unit tests into domain category folders - Consolidate per-advisory GHSA regression tests into Security/ subfolders by vuln class - Group all 186 test files into domain folders: DataCollection/, Ui/, Core/, Database/, Installer/, Scripts/, Security/, Plugin/ - Strip GitHub issue/GHSA numbers from filenames; keep IDs in test descriptions - Fix all __DIR__ relative paths to match new folder nesting depth - Update CI workflow path triggers and phpunit XML configs for new file locations - Update .github/copilot-instructions.md with unit test organization guidelines - Add tests/vendor/ to .gitignore * add gaurds * fix up guard for unit tests * fix redeclaration of cacti_log in tests * fix updates to unit tests * fix test patjhs * fix: update test __DIR__ paths for reorganized test structure * fix: conditionally define read_user_setting to prevent redeclaration in tests * fix: conditionally define functions to prevent redeclaration in tests - Wrap clean_up_lines, raise_message, cacti_debug_backtrace, and get_debug_prefix with function_exists() checks to prevent conflicts when test stubs are loaded before lib/functions.php in the same PHP process * fix: add unit test bootstrap to prevent function redeclaration errors - Create tests/bootstrap-unit.php to load core libraries before tests - Ensures lib/functions.php loads before test stubs define stub functions - Test stubs use function_exists() checks, so they detect pre-loaded functions - Update phpunit.xml to use bootstrap-unit.php for Unit testsuite - Fixes 'Cannot redeclare read_user_setting()' errors when tests run in same process * fix: load test stubs before global.php in unit test bootstrap - Reorder bootstrap to load CactiStubs.php and UnitStubs.php first - Ensures stub functions like __() are available when global.php loads - global.php calls get_cacti_version_text() which needs __() for translations - Fixes 'Call to undefined function __()' error during bootstrap * fix: remove function conflicts from test stubs - Remove stub definitions for functions already in lib/functions.php: cacti_sizeof, cacti_log, cacti_strtolower, read_config_option, read_user_setting, cacti_count - Keep translation function stubs (__(), __esc()) needed by global.php - Update bootstrap to load lib/functions.php after stubs - This prevents function redeclaration errors while maintaining test isolation * fix: prevent constant and variable redeclaration in bootstrap - Remove explicit PHP_TESTING and CACTI_TEST_BOOTSTRAP defines from bootstrap (CactiStubs.php now handles this with guards) - Add guards to CactiStubs.php to prevent redefinition of PHP_TESTING - Only set CACTI_TEST_BOOTSTRAP env vars if not already set - Fixes PHP warnings about 'Constant X already defined' * fix: remove redundant lib/functions.php load from bootstrap include/global.php already loads lib/functions.php at lines 287-288. The bootstrap was trying to load it again after global.php, but global.php needs format_cacti_version() to be available on lines 293-294 to define CACTI_VERSION and CACTI_VERSION_FULL constants. Solution: Let global.php handle loading lib/functions.php itself, and don't load it separately in the bootstrap. * fix: remove more conflicting function stubs from test helpers - Remove stubs for functions also defined in lib/functions.php: raise_message, clean_up_lines, cacti_debug_backtrace, get_debug_prefix - Remove POLLER_ID constant stub (defined unconditionally by global.php) - Keep only translation functions and test-specific helpers - This prevents function/constant redeclaration errors * fix: minimize test stubs to only translation functions Remove ALL helper functions and constants from UnitStubs.php that are: - Defined in lib/functions.php (raise_message, clean_up_lines, etc.) - Defined in lib/html_utility.php (srv, set_request_var) - Defined in global_constants.php (POLLER_VERBOSITY_*, MESSAGE_LEVEL_*) - Defined in global.php (POLLER_ID) Keep ONLY translation functions (__(), __esc()) that are: - Called by global.php during initialization - Not defined elsewhere - Required for proper bootstrap sequence This eliminates all constant and function redeclaration errors. * fix: remove __esc stub - already defined in global_languages.php Keep only __() translation function stub, which is needed by global.php and not defined elsewhere in Cacti core. * fix: handle no-arg case in __() translation stub The __() function may be called with just a string and no format arguments. Previously, vsprintf() would fail with 'arguments array must contain 2 items'. Now, if no args are provided, return the text as-is.
86 lines
4.3 KiB
PHP
86 lines
4.3 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* Tests for RRDfile path escaping in the three CLI tools that shell out.
|
|
*
|
|
* Each one built its command by interpolation, and every path came from
|
|
* data_template_data.data_source_path, which the web UI writes and an XML
|
|
* template import can also set:
|
|
*
|
|
* batchgapfix.php --rrdfile='$path' (single quotes only)
|
|
* float_rrdfiles.php "$rrdtool_bin dump $rrd_path"
|
|
* update_heartbeat.php sprintf('rrdtool tune %s ', $f['rrd'])
|
|
*
|
|
* A path holding a quote or a shell operator therefore ran as the account
|
|
* invoking the tool, which is not the account that wrote the path.
|
|
*/
|
|
|
|
$batchgapfixSource = file_get_contents(dirname(__DIR__, 4) . '/cli/batchgapfix.php');
|
|
$floatRrdfilesSource = file_get_contents(dirname(__DIR__, 4) . '/cli/float_rrdfiles.php');
|
|
$updateHeartbeatSource = file_get_contents(dirname(__DIR__, 4) . '/cli/update_heartbeat.php');
|
|
|
|
// --- batchgapfix ---
|
|
|
|
test('batchgapfix escapes the RRDfile path handed to removespikes', function () use ($batchgapfixSource) {
|
|
expect($batchgapfixSource)->toContain('cacti_escapeshellarg($rrdfile[\'data_source_path\'])');
|
|
expect($batchgapfixSource)->not->toContain('--rrdfile=\'%s\'');
|
|
});
|
|
|
|
test('batchgapfix escapes the window and method arguments', function () use ($batchgapfixSource) {
|
|
expect($batchgapfixSource)->toContain('cacti_escapeshellarg($start_date)');
|
|
expect($batchgapfixSource)->toContain('cacti_escapeshellarg($end_date)');
|
|
expect($batchgapfixSource)->toContain('cacti_escapeshellarg($method)');
|
|
expect($batchgapfixSource)->toContain('cacti_escapeshellarg($avgnan)');
|
|
});
|
|
|
|
test('batchgapfix spawns its children with an argument array', function () use ($batchgapfixSource) {
|
|
expect($batchgapfixSource)->toContain('exec_background($php_bin, $args)');
|
|
expect($batchgapfixSource)->not->toContain('exec_background($php_bin, $command)');
|
|
});
|
|
|
|
// --- float_rrdfiles ---
|
|
|
|
test('float_rrdfiles escapes the RRDfile path on dump', function () use ($floatRrdfilesSource) {
|
|
expect($floatRrdfilesSource)->toContain("(string) read_config_option('path_rrdtool')");
|
|
expect($floatRrdfilesSource)->toContain('cacti_escapeshellcmd($rrdtool_bin) . \' dump \' . cacti_escapeshellarg($rrd_path)');
|
|
expect($floatRrdfilesSource)->not->toContain('"$rrdtool_bin dump $rrd_path"');
|
|
});
|
|
|
|
test('batchgapfix normalizes an unset PHP binary path', function () use ($batchgapfixSource) {
|
|
expect($batchgapfixSource)->toContain("(string) read_config_option('path_php_binary')");
|
|
});
|
|
|
|
test('float_rrdfiles escapes both paths on restore', function () use ($floatRrdfilesSource) {
|
|
expect($floatRrdfilesSource)->toContain('cacti_escapeshellarg($tmp_file)');
|
|
expect($floatRrdfilesSource)->not->toContain('"$rrdtool_bin restore -f $tmp_file $rrd_path"');
|
|
});
|
|
|
|
// --- update_heartbeat ---
|
|
|
|
test('update_heartbeat escapes the RRDfile path', function () use ($updateHeartbeatSource) {
|
|
expect($updateHeartbeatSource)->toContain('cacti_escapeshellarg($f[\'rrd\'])');
|
|
expect($updateHeartbeatSource)->not->toContain('sprintf(\'rrdtool tune %s \'');
|
|
});
|
|
|
|
test('update_heartbeat escapes each data source name', function () use ($updateHeartbeatSource) {
|
|
expect($updateHeartbeatSource)->toContain('cacti_escapeshellarg($ds . \':\' . $new_heartbeat)');
|
|
expect($updateHeartbeatSource)->not->toContain('--heartbeat $ds:$new_heartbeat');
|
|
});
|
|
|
|
test('update_heartbeat takes RRDtool from the configured path', function () use ($updateHeartbeatSource) {
|
|
expect($updateHeartbeatSource)->toContain('$rrdtool_bin = read_config_option(\'path_rrdtool\')');
|
|
expect($updateHeartbeatSource)->toContain('cacti_escapeshellcmd($rrdtool_bin)');
|
|
});
|