mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
Thomas VincentandTheWitness
f2a5ef0d51
* fix: cast path_php_binary before passing it to string parameters The setting has no default, so it is null on a fresh install, and PHP 9 turns the resulting coercion from a deprecation into a TypeError. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: append the changelog entry at the end of the issue block Matches .github/copilot-instructions.md, which appends rather than inserting in numeric order. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: use the full licence header on the new test files Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix: cast path_php_binary at every site that escapes it The first pass covered three of them; a repo-wide scan found 21, and the test now fails if a new one appears. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: strengthen PHP binary path guard * fix: cover default-config PHP binary reads --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>
67 lines
3.0 KiB
PHP
67 lines
3.0 KiB
PHP
<?php
|
|
/*
|
|
+-------------------------------------------------------------------------+
|
|
| Copyright (C) 2004-2026 The Cacti Group |
|
|
| |
|
|
| This program is free software; you can redistribute it and/or |
|
|
| modify it under the terms of the GNU General Public License |
|
|
| as published by the Free Software Foundation; either version 2 |
|
|
| of the License, or (at your option) any later version. |
|
|
+-------------------------------------------------------------------------+
|
|
| Cacti: The Complete RRDtool-based Graphing Solution |
|
|
+-------------------------------------------------------------------------+
|
|
*/
|
|
|
|
/*
|
|
* Tests for command injection hardening in graph_realtime.php.
|
|
*
|
|
* grv('local_graph_id') was interpolated into shell_exec via sprintf without
|
|
* escaping. The fix casts to (int), uses cacti_escapeshellcmd for the PHP
|
|
* binary, and cacti_escapeshellarg for the script path.
|
|
*/
|
|
|
|
$graphRealtimePath = __DIR__ . '/../../graph_realtime.php';
|
|
|
|
// --- graph_realtime.php: shell escaping for poller invocation ---
|
|
|
|
test('graph_realtime.php uses cacti_escapeshellcmd for PHP binary', function () use ($graphRealtimePath) {
|
|
$contents = file_get_contents($graphRealtimePath);
|
|
|
|
expect($contents)->toContain("cacti_escapeshellcmd((string) read_config_option('path_php_binary')");
|
|
});
|
|
|
|
test('graph_realtime.php uses cacti_escapeshellarg for poller_realtime script path', function () use ($graphRealtimePath) {
|
|
$contents = file_get_contents($graphRealtimePath);
|
|
|
|
expect($contents)->toContain('cacti_escapeshellarg(CACTI_PATH_BASE');
|
|
expect($contents)->toContain('poller_realtime.php');
|
|
});
|
|
|
|
test('graph_realtime.php casts local_graph_id to int before shell_exec', function () use ($graphRealtimePath) {
|
|
$contents = file_get_contents($graphRealtimePath);
|
|
|
|
expect($contents)->toMatch('/\(int\)\s+gfrv\s*\(\s*[\'"]local_graph_id[\'"]\s*\)/');
|
|
});
|
|
|
|
test('graph_realtime.php quotes the realtime poller token', function () use ($graphRealtimePath) {
|
|
$contents = file_get_contents($graphRealtimePath);
|
|
|
|
expect($contents)->toContain('cacti_escapeshellarg($poller_id)');
|
|
expect($contents)->toContain("hash('sha256', session_id())");
|
|
});
|
|
|
|
test('graph_realtime.php does not pass raw grv local_graph_id to sprintf for shell', function () use ($graphRealtimePath) {
|
|
$contents = file_get_contents($graphRealtimePath);
|
|
|
|
expect($contents)->not->toMatch('/sprintf\s*\([^)]*grv\s*\(\s*[\'"]local_graph_id[\'"]\s*\)/');
|
|
});
|
|
|
|
test('poller_realtime.php keeps poller_id as a validated string token', function () {
|
|
$contents = file_get_contents(__DIR__ . '/../../poller_realtime.php');
|
|
|
|
expect($contents)->toContain('$poller_id = (string) $value;');
|
|
expect($contents)->toContain("preg_match('/^(?:[0-9]+|[A-Fa-f0-9]{64})$/', \$poller_id)");
|
|
expect($contents)->toContain('function process_poller_output_rt(mixed $rrdtool_pipe, string $poller_id, int $interval) : int');
|
|
expect($contents)->not->toContain('$poller_id = intval($value);');
|
|
});
|