mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-29 08:06:58 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
41 lines
1.5 KiB
PHP
41 lines
1.5 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-967c-6qj7-q7rh: a |query_*| rrd_maximum token, substituted from an
|
|
* attacker-influenced SNMP field value, could carry a newline into the rrdtool
|
|
* 'create' command and inject an independent rrdtool-protocol command. The
|
|
* choke point __rrd_execute() strips control characters from the assembled
|
|
* command before it reaches the rrdtool pipe, closing both the RRD-create path
|
|
* here and the sibling graph-render path (GHSA-hcj6-pmvx-fwgr).
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
$source = file_get_contents($root . '/lib/rrd.php');
|
|
|
|
test('__rrd_execute strips control characters before executing', function () use ($source) {
|
|
$pos = strpos($source, 'function __rrd_execute(');
|
|
|
|
expect($pos)->not->toBeFalse();
|
|
|
|
$end = strpos($source, "\nfunction ", $pos + 1);
|
|
$body = substr($source, $pos, $end - $pos);
|
|
|
|
expect($body)->toContain('rrd_strip_control_chars($command_line)');
|
|
});
|
|
|
|
test('rrd_strip_control_chars removes the control bytes that enable pipe injection', function () use ($source) {
|
|
$pos = strpos($source, 'function rrd_strip_control_chars(');
|
|
|
|
expect($pos)->not->toBeFalse();
|
|
|
|
$end = strpos($source, "\nfunction ", $pos + 1);
|
|
$body = substr($source, $pos, $end - $pos);
|
|
|
|
expect($body)->toContain('\x00-\x1f');
|
|
});
|