mirror of
https://github.com/Cacti/cacti.git
synced 2026-11-03 10:37:46 +09:00
Thomas Vincent
3c9678007a
* fix(security): reject unsupported nested shell grammar Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(security): exercise nested grammar rejection in CI coverage Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
18 lines
895 B
PHP
18 lines
895 B
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| Licensed under the GNU General Public License, version 2 or later. |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
test('substituted shell fields retain literal values across quote and backslash contexts', function () {
|
|
$fixture = dirname(__DIR__, 3) . '/fixtures/Core/ScriptFieldShellRoundTrip.php';
|
|
$output = [];
|
|
$status = 0;
|
|
exec(escapeshellarg(PHP_BINARY) . ' ' . escapeshellarg($fixture), $output, $status);
|
|
expect($status)->toBe(0);
|
|
$result = json_decode(implode("\n", $output), true, 512, JSON_THROW_ON_ERROR);
|
|
expect($result['passed'])->toBe(103);
|
|
})->skip(stripos(PHP_OS, 'WIN') === 0 || !function_exists('exec') || !function_exists('proc_open'), 'POSIX shell required');
|