Files
cacti/tests/Unit/Security/ShellInjection/ScriptSubstitutionMatrixTest.php
T
TheWitness eb4ca6b53e fix(security): clear quote-empty flag on single-quote content; cover new parser branches
The stack-based substitute_script_path() rewrite left quoteEmpty set while emitting literal content inside a single-quoted region, so a template like '\<field>' wrongly took the exact-wrap branch and dropped the backslash (ScriptSubstitutionMatrix 'shell 56'). Clear the frame's quoteEmpty whenever a single-quoted character is emitted, matching the pre-rewrite fallthrough.

ScriptSubstitutionMatrix.php: add 8 explicit parser cases exercising the \/backtick nested contexts and escaped \$ / backtick pairing so every rewritten line is covered by the changed-coverage probe (1285 -> 1293).
2026-10-12 08:38:10 -04:00

16 lines
748 B
PHP

<?php
// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
test('quoted script fields remain literal across parser and POSIX shell boundary cases', function () {
$fixture = dirname(__DIR__, 3) . '/fixtures/Core/ScriptSubstitutionMatrix.php';
$pipes = [];
$process = proc_open([PHP_BINARY, $fixture], [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
expect(is_resource($process))->toBeTrue();
$output = stream_get_contents($pipes[1]);
$errors = stream_get_contents($pipes[2]);
fclose($pipes[1]);
fclose($pipes[2]);
expect(proc_close($process))->toBe(0)->and($errors)->toBe('');
expect(json_decode($output, true, 512, JSON_THROW_ON_ERROR)['passed'])->toBe(1293);
})->skip(PHP_OS_FAMILY === 'Windows', 'POSIX shell required');