mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-30 08:37:01 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
29 lines
1.3 KiB
PHP
29 lines
1.3 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-h745-3r76-g253: the data-query name and field name reached the New
|
|
* Graphs XML parse error messages through __() (no escaping). Both
|
|
* name-bearing messages (the xmlfielderr branch and the data-query-name
|
|
* xmlerror branch) must use __esc(); the id-only xmlerror carries no user
|
|
* string and stays on __().
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
test('New Graphs escapes the data-query and field names in every name-bearing parse error', function () use ($root) {
|
|
$source = file_get_contents($root . '/graphs_new.php');
|
|
|
|
// the two name-bearing messages escape; the id-only message does not
|
|
expect(substr_count($source, "__esc('Error Parsing Data Query Resource XML file"))->toBe(2)
|
|
->and(substr_count($source, "__('Error Parsing Data Query Resource XML file"))->toBe(1)
|
|
->and($source)->toContain("raise_message('xmlfielderr' . \$field_name, __esc(")
|
|
->and($source)->not->toContain("raise_message('xmlfielderr' . \$field_name, __(");
|
|
});
|