mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-30 08:37:01 +09:00
TheWitness
7b551eea72
Excludes vendored packages, third-party JS, patches, and the Win32 probe fixture. Pure EOL change; guards pass and php -l is clean.
43 lines
1.7 KiB
PHP
43 lines
1.7 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* GHSA-9737-rqh3-h7fh: names interpolated into raise_message() went through
|
|
* __() (no escaping) across many pages. Those sinks now use __esc(). A static
|
|
* URL in the message text does not exempt a line whose interpolated value still
|
|
* needs escaping. This asserts no name-bearing unescaped form remains in the
|
|
* swept files.
|
|
*/
|
|
|
|
$root = dirname(__DIR__, 4);
|
|
|
|
$files = array('/lib/api_device.php', '/host.php', '/lib/utility.php', '/package_repos.php', '/package_import.php');
|
|
|
|
test('no name-bearing raise_message(..., __(...$...)) remains in the swept files', function () use ($root, $files) {
|
|
foreach ($files as $file) {
|
|
$source = file_get_contents($root . $file);
|
|
|
|
foreach (explode("\n", $source) as $line) {
|
|
if (strpos($line, 'raise_message(') !== false
|
|
&& strpos($line, ', __(') !== false
|
|
&& strpos($line, '$') !== false
|
|
&& strpos($line, 'html_escape') === false
|
|
// messages that intentionally build an HTML anchor or issue a
|
|
// redirect are excluded, exactly as the conversion was; a static
|
|
// URL in display text is not a reason to skip escaping
|
|
&& preg_match('/<[a-zA-Z\/]|&[a-z]+;|&#/', $line) === 0
|
|
&& preg_match('/href|<a |url_path|Location:/', $line) === 0) {
|
|
expect($line)->toBe('__swept__:' . $file);
|
|
}
|
|
}
|
|
}
|
|
|
|
expect(true)->toBeTrue();
|
|
});
|