|
Lines 39-52
my $xslt=<<"EOT";
Link Here
|
| 39 |
</xsl:template> |
39 |
</xsl:template> |
| 40 |
</xsl:stylesheet> |
40 |
</xsl:stylesheet> |
| 41 |
EOT |
41 |
EOT |
| 42 |
my $xslt_file = mytempfile($xslt); |
42 |
my $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); |
| 43 |
|
|
|
| 44 |
my $output= $engine->transform( "<ignored/>", $xslt_file ); |
| 45 |
like($output, qr/Big secret/, 'external entity got through'); |
43 |
like($output, qr/Big secret/, 'external entity got through'); |
| 46 |
|
44 |
|
| 47 |
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } ); |
45 |
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } ); |
| 48 |
$engine=Koha::XSLT::Base->new; |
46 |
$engine=Koha::XSLT::Base->new; |
| 49 |
$output= $engine->transform( "<ignored/>", $xslt_file ); |
47 |
$output= $engine->transform({ xml => "<ignored/>", code => $xslt }); |
| 50 |
unlike($output, qr/Big secret/, 'external entity did not get through'); |
48 |
unlike($output, qr/Big secret/, 'external entity did not get through'); |
| 51 |
|
49 |
|
| 52 |
# Adding a document call to trigger callback for read_file |
50 |
# Adding a document call to trigger callback for read_file |
|
Lines 59-66
$xslt=<<"EOT";
Link Here
|
| 59 |
</xsl:template> |
57 |
</xsl:template> |
| 60 |
</xsl:stylesheet> |
58 |
</xsl:stylesheet> |
| 61 |
EOT |
59 |
EOT |
| 62 |
$xslt_file = mytempfile($xslt); |
60 |
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); } |
| 63 |
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); } |
|
|
| 64 |
[ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ], |
61 |
[ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ], |
| 65 |
'Triggered security callback for read_file'; |
62 |
'Triggered security callback for read_file'; |
| 66 |
|
63 |
|
|
Lines 73-80
$xslt=<<"EOT";
Link Here
|
| 73 |
</xsl:template> |
70 |
</xsl:template> |
| 74 |
</xsl:stylesheet> |
71 |
</xsl:stylesheet> |
| 75 |
EOT |
72 |
EOT |
| 76 |
$xslt_file = mytempfile($xslt); |
73 |
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); } |
| 77 |
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); } |
|
|
| 78 |
[ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ], |
74 |
[ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ], |
| 79 |
'Triggered security callback for write_file'; |
75 |
'Triggered security callback for write_file'; |
| 80 |
|
76 |
|
|
Lines 87-94
$xslt=<<"EOT";
Link Here
|
| 87 |
</xsl:template> |
83 |
</xsl:template> |
| 88 |
</xsl:stylesheet> |
84 |
</xsl:stylesheet> |
| 89 |
EOT |
85 |
EOT |
| 90 |
$xslt_file = mytempfile($xslt); |
86 |
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); } |
| 91 |
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); } |
|
|
| 92 |
[ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ], |
87 |
[ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ], |
| 93 |
'Triggered security callback for read_net'; |
88 |
'Triggered security callback for read_net'; |
| 94 |
|
89 |
|
|
Lines 103-110
$xslt=<<"EOT";
Link Here
|
| 103 |
</xsl:template> |
98 |
</xsl:template> |
| 104 |
</xsl:stylesheet> |
99 |
</xsl:stylesheet> |
| 105 |
EOT |
100 |
EOT |
| 106 |
$xslt_file = mytempfile($xslt); |
101 |
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); } |
| 107 |
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); } |
|
|
| 108 |
[ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ], |
102 |
[ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ], |
| 109 |
'Triggered security callback for write_net'; |
103 |
'Triggered security callback for write_net'; |
| 110 |
|
104 |
|
|
Lines 118-136
$xslt=<<"EOT";
Link Here
|
| 118 |
<xsl:template match="/"/> |
112 |
<xsl:template match="/"/> |
| 119 |
</xsl:stylesheet> |
113 |
</xsl:stylesheet> |
| 120 |
EOT |
114 |
EOT |
| 121 |
$xslt_file = mytempfile($xslt); |
|
|
| 122 |
$engine->print_warns(1); |
115 |
$engine->print_warns(1); |
| 123 |
{ |
116 |
{ |
| 124 |
my @warn; |
117 |
my @warn; |
| 125 |
local $SIG{__WARN__} = sub { push @warn, $_[0]; }; |
118 |
local $SIG{__WARN__} = sub { push @warn, $_[0]; }; |
| 126 |
$output= $engine->transform( "<ignored/>", $xslt_file ); |
119 |
$output= $engine->transform({ xml => "<ignored/>", code => $xslt }); |
| 127 |
is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' ); |
120 |
is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' ); |
| 128 |
is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' ); |
121 |
is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' ); |
| 129 |
} |
122 |
} |
| 130 |
|
123 |
|
| 131 |
sub mytempfile { |
124 |
sub mytempfile { |
| 132 |
my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 ); |
125 |
my ($fh, $fn) = tempfile( UNLINK => 1 ); |
| 133 |
print $fh $_[0]//''; |
126 |
print $fh $_[0] if $_[0]; |
| 134 |
close $fh; |
127 |
close $fh; |
| 135 |
return $fn; |
128 |
return $fn; |
| 136 |
} |
129 |
} |
| 137 |
- |
|
|