Attachment #99754 for bug #24756

View | Details | Raw Unified | Return to bug 24756
Collapse All | Expand All




  </xsl:template>
</xsl:stylesheet>
EOT
my $output= $engine->transform({ xml => "<ignored/>", code => $xslt });

my $output= $engine->transform( "<ignored/>", $xslt_file );
like($output, qr/Big secret/, 'external entity got through');

t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
$engine=Koha::XSLT::Base->new;
$output= $engine->transform({ xml => "<ignored/>", code => $xslt });
unlike($output, qr/Big secret/, 'external entity did not get through');

# Adding a document call to trigger callback for read_file

  </xsl:template>
</xsl:stylesheet>
EOT
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
    [ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ],
    'Triggered security callback for read_file';


  </xsl:template>
</xsl:stylesheet>
EOT
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
    [ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ],
    'Triggered security callback for write_file';


  </xsl:template>
</xsl:stylesheet>
EOT
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
    [ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ],
    'Triggered security callback for read_net';


  </xsl:template>
</xsl:stylesheet>
EOT
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
    [ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ],
    'Triggered security callback for write_net';


  <xsl:template match="/"/>
</xsl:stylesheet>
EOT
$xslt_file = mytempfile($xslt);
$engine->print_warns(1);
{
    my @warn;
    local $SIG{__WARN__} = sub { push @warn, $_[0]; };
    $output= $engine->transform({ xml => "<ignored/>", code => $xslt });
    is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' );
    is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' );
}

sub mytempfile {
    my ($fh, $fn) = tempfile( UNLINK => 1 );
    print $fh $_[0] if $_[0];
    close $fh;
    return $fn;
}
- 

Return to bug 24756

Lines 39-52 my $xslt=<<"EOT"; Link Here

(-)a/t/db_dependent/Koha/XSLT/Security.t (-17 / +9 lines)
39	</xsl:template>	39	</xsl:template>
40	</xsl:stylesheet>	40	</xsl:stylesheet>
41	EOT	41	EOT
42	my $xslt_file = mytempfile($xslt);	42	my $output= $engine->transform({ xml => "<ignored/>", code => $xslt });
43
44	my $output= $engine->transform( "<ignored/>", $xslt_file );
45	like($output, qr/Big secret/, 'external entity got through');	43	like($output, qr/Big secret/, 'external entity got through');
46		44
47	t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );	45	t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
48	$engine=Koha::XSLT::Base->new;	46	$engine=Koha::XSLT::Base->new;
49	$output= $engine->transform( "<ignored/>", $xslt_file );	47	$output= $engine->transform({ xml => "<ignored/>", code => $xslt });
50	unlike($output, qr/Big secret/, 'external entity did not get through');	48	unlike($output, qr/Big secret/, 'external entity did not get through');
51		49
52	# Adding a document call to trigger callback for read_file	50	# Adding a document call to trigger callback for read_file
Lines 59-66 $xslt=<<"EOT"; Link Here
59	</xsl:template>	57	</xsl:template>
60	</xsl:stylesheet>	58	</xsl:stylesheet>
61	EOT	59	EOT
62	$xslt_file = mytempfile($xslt);	60	warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
63	warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
64	[ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ],	61	[ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ],
65	'Triggered security callback for read_file';	62	'Triggered security callback for read_file';
66		63
Lines 73-80 $xslt=<<"EOT"; Link Here
73	</xsl:template>	70	</xsl:template>
74	</xsl:stylesheet>	71	</xsl:stylesheet>
75	EOT	72	EOT
76	$xslt_file = mytempfile($xslt);	73	warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
77	warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
78	[ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ],	74	[ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ],
79	'Triggered security callback for write_file';	75	'Triggered security callback for write_file';
80		76
Lines 87-94 $xslt=<<"EOT"; Link Here
87	</xsl:template>	83	</xsl:template>
88	</xsl:stylesheet>	84	</xsl:stylesheet>
89	EOT	85	EOT
90	$xslt_file = mytempfile($xslt);	86	warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
91	warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
92	[ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ],	87	[ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ],
93	'Triggered security callback for read_net';	88	'Triggered security callback for read_net';
94		89
Lines 103-110 $xslt=<<"EOT"; Link Here
103	</xsl:template>	98	</xsl:template>
104	</xsl:stylesheet>	99	</xsl:stylesheet>
105	EOT	100	EOT
106	$xslt_file = mytempfile($xslt);	101	warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
107	warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
108	[ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ],	102	[ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ],
109	'Triggered security callback for write_net';	103	'Triggered security callback for write_net';
110		104
Lines 118-136 $xslt=<<"EOT"; Link Here
118	<xsl:template match="/"/>	112	<xsl:template match="/"/>
119	</xsl:stylesheet>	113	</xsl:stylesheet>
120	EOT	114	EOT
121	$xslt_file = mytempfile($xslt);
122	$engine->print_warns(1);	115	$engine->print_warns(1);
123	{	116	{
124	my @warn;	117	my @warn;
125	local $SIG{__WARN__} = sub { push @warn, $_[0]; };	118	local $SIG{__WARN__} = sub { push @warn, $_[0]; };
126	$output= $engine->transform( "<ignored/>", $xslt_file );	119	$output= $engine->transform({ xml => "<ignored/>", code => $xslt });
127	is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' );	120	is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' );
128	is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' );	121	is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' );
129	}	122	}
130		123
131	sub mytempfile {	124	sub mytempfile {
132	my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 );	125	my ($fh, $fn) = tempfile( UNLINK => 1 );
133	print $fh $_[0]//'';	126	print $fh $_[0] if $_[0];
134	close $fh;	127	close $fh;
135	return $fn;	128	return $fn;
136	}	129	}
137	-