mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-30 08:37:01 +09:00
TheWitness
1a37594ad6
* chore: replace unmaintained phpdiff vendor lib with jfcherng/php-diff The manually-vendored include/vendor/phpdiff (chrisboulton/php-diff v1.1, 2009 - unmaintained since ~2013) backed the package-import file diff viewer (package_import.php's package_diff_file()), its only call site. Replace it with jfcherng/php-diff (^6.16, BSD-3-Clause), an actively maintained continuation of the same library, declared as a real Composer dependency in composer.json/composer.lock (installed at build/CI time, same as this branch's other composer.json dependencies - not committed to include/vendor, unlike the old hand-vendored phpdiff). package_import.php now uses Jfcherng\Diff\Differ + RendererFactory in place of the old Diff/Diff_Renderer_Html_Inline classes. Preserved the existing nosemgrep justification comment, updated to reference the new library's AbstractHtml::htmlSafe() escaping. Adopted the vendor's own diff-table.css as the Diff.css in all 10 themes, replacing the bespoke per-theme stylesheets that were tied to the old library's class names. * fix: address review feedback on jfcherng/php-diff migration - package_import.php: narrow $oldfile/$newfile to array before constructing Jfcherng\Diff\Differ so PHPStan can see the false branch is excluded (fixes level 6/8 analysis failure). - tests/tools/check_vendor_policy.php: drop the removed include/vendor/phpdiff/ path from the legacy allowlist. - tests/Unit/Security/Xss/PackageDiffRendererTest.php: rewrite against the new Jfcherng\Diff\Differ/RendererFactory API instead of the deleted vendored phpdiff classes.
27 lines
1.2 KiB
PHP
27 lines
1.2 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
use Jfcherng\Diff\Differ;
|
|
use Jfcherng\Diff\Factory\RendererFactory;
|
|
|
|
test('package inline diffs escape file content before adding markup', function () {
|
|
$payload = "</td></tr></table><script>alert('xss')</script>";
|
|
$differ = new Differ(['safe'], [$payload], ['ignoreWhitespace' => true, 'ignoreCase' => false]);
|
|
$renderer = RendererFactory::make('Inline');
|
|
$html = $renderer->render($differ);
|
|
|
|
expect($html)->toContain('<script>')
|
|
->and($html)->toContain('</script>')
|
|
->and($html)->not->toContain('<script>')
|
|
->and($html)->not->toContain('</table><script>');
|
|
});
|