Attachment 97614 Details for Bug 23290 – Bug 23290: Add test Koha/XSLT/Security.t

[patch] Bug 23290: Add test Koha/XSLT/Security.t

Bug-23290-Add-test-KohaXSLTSecurityt.patch (text/plain), 5.28 KB, created by Marcel de Rooy on 2020-01-20 08:38:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2020-01-20 08:38:53 UTC

Size: 5.28 KB

patch

obsolete

>From 72ff3ee26908316ea97fc0f59174451e6ba14ee6 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Fri, 15 Nov 2019 13:19:50 +0000
>Subject: [PATCH] Bug 23290: Add test Koha/XSLT/Security.t
>Content-Type: text/plain; charset=utf-8
>
>Test plan:
>Run it!
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>
>Signed-off-by: David Cook <dcook@prosentient.com.au>
>---
> t/db_dependent/Koha/XSLT/Security.t | 116 ++++++++++++++++++++++++++++++++++++
> 1 file changed, 116 insertions(+)
> create mode 100644 t/db_dependent/Koha/XSLT/Security.t
>
>diff --git a/t/db_dependent/Koha/XSLT/Security.t b/t/db_dependent/Koha/XSLT/Security.t
>new file mode 100644
>index 0000000000..a934481feb
>--- /dev/null
>+++ b/t/db_dependent/Koha/XSLT/Security.t
>@@ -0,0 +1,116 @@
>+#!/usr/bin/perl
>+
>+# Copyright 2019 Rijksmuseum
>+#
>+# This file is part of Koha.
>+#
>+# Koha is free software; you can redistribute it and/or modify it under the
>+# terms of the GNU General Public License as published by the Free Software
>+# Foundation; either version 3 of the License, or (at your option) any later
>+# version.
>+#
>+# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
>+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
>+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
>+#
>+# You should have received a copy of the GNU General Public License along
>+# with Koha; if not, write to the Free Software Foundation, Inc.,
>+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
>+
>+use Modern::Perl;
>+use File::Temp qw/tempfile/;
>+use Test::More tests => 6;
>+use Test::Warn;
>+
>+use Koha::XSLT::Base;
>+use t::lib::Mocks;
>+
>+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );
>+my $engine=Koha::XSLT::Base->new;
>+
>+my $secret_file = mytempfile('Big secret');
>+my $xslt=<<"EOT";
>+<!DOCTYPE test [<!ENTITY secret SYSTEM "$secret_file">]>
>+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
>+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
>+  <xsl:variable name="secret">&secret;</xsl:variable>
>+  <xsl:template match="/">
>+      <secret><xsl:value-of select="\$secret"/></secret>
>+  </xsl:template>
>+</xsl:stylesheet>
>+EOT
>+my $xslt_file = mytempfile($xslt);
>+
>+my $output= $engine->transform( "<ignored/>", $xslt_file );
>+like($output, qr/Big secret/, 'external entity got through');
>+
>+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );
>+$engine=Koha::XSLT::Base->new;
>+$output= $engine->transform( "<ignored/>", $xslt_file );
>+unlike($output, qr/Big secret/, 'external entity did not get through');
>+
>+# Adding a document call to trigger callback for read_file
>+# Does not depend on expand_entities.
>+$xslt=<<"EOT";
>+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
>+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
>+  <xsl:template match="/">
>+      <read_file><xsl:copy-of select="document('file://$secret_file')"/></read_file>
>+  </xsl:template>
>+</xsl:stylesheet>
>+EOT
>+$xslt_file = mytempfile($xslt);
>+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
>+    qr/read_file called in XML::LibXSLT/,
>+    'Triggered security callback for read_file';
>+
>+# Trigger write_file
>+$xslt=<<"EOT";
>+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" extension-element-prefixes="exsl">
>+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
>+  <xsl:template match="/">
>+      <exsl:document href="file:///tmp/breached.txt" omit-xml-declaration="yes" method="text"><xsl:text>Breached!</xsl:text></exsl:document>
>+  </xsl:template>
>+</xsl:stylesheet>
>+EOT
>+$xslt_file = mytempfile($xslt);
>+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
>+    qr/write_file called in XML::LibXSLT/,
>+    'Triggered security callback for write_file';
>+
>+# Trigger read_net
>+$xslt=<<"EOT";
>+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
>+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
>+  <xsl:template match="/">
>+      <xsl:copy-of select="document('http://bad.koha-community.org/dangerous/exploit.xsl')" />
>+  </xsl:template>
>+</xsl:stylesheet>
>+EOT
>+$xslt_file = mytempfile($xslt);
>+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
>+    qr/read_net called in XML::LibXSLT/,
>+    'Triggered security callback for read_net';
>+
>+# Check remote import (include should be similar)
>+# Trusting koha-community.org DNS here ;)
>+# This should not trigger read_net but fail on the missing import.
>+$xslt=<<"EOT";
>+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
>+  <xsl:import href="http://notexpected.koha-community.org/noxsl/nothing.xsl"/>
>+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
>+  <xsl:template match="/"/>
>+</xsl:stylesheet>
>+EOT
>+$xslt_file = mytempfile($xslt);
>+$engine->print_warns(1);
>+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
>+    qr/I\/O warning : failed to load external entity/,
>+    'Remote import does not fail on read_net';
>+
>+sub mytempfile {
>+    my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 );
>+    print $fh $_[0]//'';
>+    close $fh;
>+    return $fn;
>+}
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 23290: 91435 | 91437 | 95450 | 95451 | 95452 | 95453 | 95454 | 95475 | 95478 | 95480 | 95481 | 95482 | 95483 | 95484 | 95485 | 95551 | 96299 | 96300 | 96301 | 96302 | 96303 | 96304 | 97606 | 97607 | 97608 | 97609 | 97610 | 97611 | 97612 | 97613 | 97614 | 97615 | 97616 | 97617 | 97618 | 97619 | 97620 | 97871 | 97978 | 97980 | 98397 | 98398 | 98399 | 98400 | 98401 | 98402 | 98403 | 98404 | 98405 | 98406 | 99587