View | Details | Raw Unified | Return to bug 24756
Collapse All | Expand All

(-)a/t/db_dependent/Koha/XSLT/Security.t (-17 / +9 lines)
Lines 39-52 my $xslt=<<"EOT"; Link Here
39
  </xsl:template>
39
  </xsl:template>
40
</xsl:stylesheet>
40
</xsl:stylesheet>
41
EOT
41
EOT
42
my $xslt_file = mytempfile($xslt);
42
my $output= $engine->transform({ xml => "<ignored/>", code => $xslt });
43
44
my $output= $engine->transform( "<ignored/>", $xslt_file );
45
like($output, qr/Big secret/, 'external entity got through');
43
like($output, qr/Big secret/, 'external entity got through');
46
44
47
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
45
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
48
$engine=Koha::XSLT::Base->new;
46
$engine=Koha::XSLT::Base->new;
49
$output= $engine->transform( "<ignored/>", $xslt_file );
47
$output= $engine->transform({ xml => "<ignored/>", code => $xslt });
50
unlike($output, qr/Big secret/, 'external entity did not get through');
48
unlike($output, qr/Big secret/, 'external entity did not get through');
51
49
52
# Adding a document call to trigger callback for read_file
50
# Adding a document call to trigger callback for read_file
Lines 59-66 $xslt=<<"EOT"; Link Here
59
  </xsl:template>
57
  </xsl:template>
60
</xsl:stylesheet>
58
</xsl:stylesheet>
61
EOT
59
EOT
62
$xslt_file = mytempfile($xslt);
60
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
63
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
64
    [ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ],
61
    [ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ],
65
    'Triggered security callback for read_file';
62
    'Triggered security callback for read_file';
66
63
Lines 73-80 $xslt=<<"EOT"; Link Here
73
  </xsl:template>
70
  </xsl:template>
74
</xsl:stylesheet>
71
</xsl:stylesheet>
75
EOT
72
EOT
76
$xslt_file = mytempfile($xslt);
73
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
77
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
78
    [ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ],
74
    [ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ],
79
    'Triggered security callback for write_file';
75
    'Triggered security callback for write_file';
80
76
Lines 87-94 $xslt=<<"EOT"; Link Here
87
  </xsl:template>
83
  </xsl:template>
88
</xsl:stylesheet>
84
</xsl:stylesheet>
89
EOT
85
EOT
90
$xslt_file = mytempfile($xslt);
86
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
91
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
92
    [ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ],
87
    [ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ],
93
    'Triggered security callback for read_net';
88
    'Triggered security callback for read_net';
94
89
Lines 103-110 $xslt=<<"EOT"; Link Here
103
  </xsl:template>
98
  </xsl:template>
104
</xsl:stylesheet>
99
</xsl:stylesheet>
105
EOT
100
EOT
106
$xslt_file = mytempfile($xslt);
101
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
107
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
108
    [ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ],
102
    [ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ],
109
    'Triggered security callback for write_net';
103
    'Triggered security callback for write_net';
110
104
Lines 118-136 $xslt=<<"EOT"; Link Here
118
  <xsl:template match="/"/>
112
  <xsl:template match="/"/>
119
</xsl:stylesheet>
113
</xsl:stylesheet>
120
EOT
114
EOT
121
$xslt_file = mytempfile($xslt);
122
$engine->print_warns(1);
115
$engine->print_warns(1);
123
{
116
{
124
    my @warn;
117
    my @warn;
125
    local $SIG{__WARN__} = sub { push @warn, $_[0]; };
118
    local $SIG{__WARN__} = sub { push @warn, $_[0]; };
126
    $output= $engine->transform( "<ignored/>", $xslt_file );
119
    $output= $engine->transform({ xml => "<ignored/>", code => $xslt });
127
    is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' );
120
    is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' );
128
    is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' );
121
    is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' );
129
}
122
}
130
123
131
sub mytempfile {
124
sub mytempfile {
132
    my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 );
125
    my ($fh, $fn) = tempfile( UNLINK => 1 );
133
    print $fh $_[0]//'';
126
    print $fh $_[0] if $_[0];
134
    close $fh;
127
    close $fh;
135
    return $fn;
128
    return $fn;
136
}
129
}
137
- 

Return to bug 24756