mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-02 18:17:00 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
63 lines
2.6 KiB
PHP
63 lines
2.6 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* SQL-injection hardening regressions. Each assertion pins a
|
|
* sibling-of-already-fixed SQLi sink: db_column_exists (GHSA-rp5g), the
|
|
* automation pivot builders (GHSA-vx2m), aggregate_make_sql_where (GHSA-929h),
|
|
* cli/add_graphs REGEXP (GHSA-mfw8), the plugin DDL identifiers (GHSA-h5wg),
|
|
* the user_admin sort_column pivot (GHSA-m49v), and the already-bound group
|
|
* filter (GHSA-wfcf).
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
test('db_column_exists quotes its LIKE term on the query connection (GHSA-rp5g)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/database.php');
|
|
expect($s)->toContain('db_qstr($column, $db_conn)')
|
|
->and($s)->not->toContain('LIKE \'$column\'');
|
|
});
|
|
|
|
test('automation pivot builders escape field_name (GHSA-vx2m)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/api_automation.php');
|
|
// The leading literal's quote style varies (strings with \n\t stay double-quoted, others are single),
|
|
// so count both forms of the db_qstr()-escaped pivot.
|
|
$escaped = substr_count($s, 'CASE WHEN field_name = " . db_qstr(')
|
|
+ substr_count($s, "CASE WHEN field_name = ' . db_qstr(");
|
|
|
|
expect($s)->not->toContain("CASE WHEN field_name='")
|
|
->and($s)->not->toContain("CASE WHEN field_name ='")
|
|
->and($escaped)->toBeGreaterThanOrEqual(3);
|
|
});
|
|
|
|
test('aggregate LIKE filter term is quoted (GHSA-929h)', function () use ($root) {
|
|
$s = file_get_contents($root . '/aggregate_graphs.php');
|
|
expect($s)->toContain("db_qstr('%'")
|
|
->and($s)->not->toContain("LIKE '%\" . trim(\$i)");
|
|
});
|
|
|
|
test('cli add_graphs uses db_qstr not addslashes for REGEXP (GHSA-mfw8)', function () use ($root) {
|
|
$s = file_get_contents($root . '/cli/add_graphs.php');
|
|
expect($s)->not->toContain('addslashes');
|
|
});
|
|
|
|
test('plugin drop/create confine the table identifier (GHSA-h5wg)', function () use ($root) {
|
|
$s = file_get_contents($root . '/lib/plugins.php');
|
|
expect($s)->not->toContain('"DROP TABLE IF EXISTS $table"')
|
|
->and($s)->toContain('!preg_match(\'/^[a-zA-Z0-9_]+$/\', $table)');
|
|
});
|
|
|
|
test('user_admin clamps sort_column to displayed columns (GHSA-m49v)', function () use ($root) {
|
|
$s = file_get_contents($root . '/user_admin.php');
|
|
expect($s)->toContain("set_request_var('sort_column', 'username')");
|
|
});
|
|
|
|
test('user_admin group filter is a bound parameter (GHSA-wfcf)', function () use ($root) {
|
|
$s = file_get_contents($root . '/user_admin.php');
|
|
expect($s)->toContain('ug.group_id = ?');
|
|
});
|