View | Details | Raw Unified | Return to bug 23290
Collapse All | Expand All

(-)a/t/db_dependent/Koha/XSLT/Security.t (-1 / +72 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# Copyright 2019 Rijksmuseum
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 3 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use Modern::Perl;
21
use File::Temp qw/tempfile/;
22
use Test::More tests => 3;
23
use Test::Warn;
24
25
use Koha::XSLT::Base;
26
use t::lib::Mocks;
27
28
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );
29
my $engine=Koha::XSLT::Base->new;
30
31
my $secret_file = mytempfile('Big secret');
32
my $xslt=<<"EOT";
33
<!DOCTYPE test [<!ENTITY secret SYSTEM "$secret_file">]>
34
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
35
  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
36
  <xsl:variable name="secret">&secret;</xsl:variable>
37
  <xsl:template match="/">
38
      <secret><xsl:value-of select="\$secret"/></secret>
39
  </xsl:template>
40
</xsl:stylesheet>
41
EOT
42
my $xslt_file = mytempfile($xslt);
43
44
my $output= $engine->transform( "<ignored/>", $xslt_file );
45
like($output, qr/Big secret/, 'external entity got through');
46
47
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );
48
$engine=Koha::XSLT::Base->new;
49
$output= $engine->transform( "<ignored/>", $xslt_file );
50
unlike($output, qr/Big secret/, 'external entity did not get through');
51
52
# Adding a document call to trigger callback for read_file
53
# Does not depend on expand_entities; we are not in strict mode now
54
$xslt=<<"EOT";
55
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
56
  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
57
  <xsl:template match="/">
58
      <a><xsl:copy-of select="document('file://$secret_file')"/></a>
59
  </xsl:template>
60
</xsl:stylesheet>
61
EOT
62
$xslt_file = mytempfile($xslt);
63
warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
64
    qr/read_file called in XML::LibXSLT/,
65
    'Triggered security callback';
66
67
sub mytempfile {
68
    my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 );
69
    print $fh $_[0]//'';
70
    close $fh;
71
    return $fn;
72
}

Return to bug 23290