Return to 460.html CVS log

Up to [parser3project] / parser3 / tests

Annotation of parser3/tests/460.html, revision 1.1

1.1     ! moko        1: # tainting: '\' is a path separator, no longer escaped on all platforms; path schemes (file://) should not be tainted
        !             2: @main[][root;text]
        !             3: # the source tree root: run_parser.sh gives no DOCUMENT_ROOT, so it is PATH_TRANSLATED without PATH_INFO=/tests/460.html
        !             4: $root[$request:document-root]
        !             5: 
        !             6: $report[^hash::create[]]
        !             7: $report.[tainted backslash][
        !             8:        $.[save, the whole name tainted][ ^outcome{ $s[text] ^s.save[^taint[460_dir\a.txt]] ^if(-f '460_dir/a.txt'){460_dir/a.txt}{NO FILE} }]
        !             9:        $.[save, the directory tainted][ ^outcome{ $s[text] ^s.save[^taint[460_dir]\b.txt] ^if(-f '460_dir/b.txt'){460_dir/b.txt}{NO FILE} }]
        !            10:        $.[-f][ ^if(-f ^taint[460_dir\a.txt]){yes}{NO}]
        !            11:        $.[load][ ^outcome{ $f[^file::load[text;^taint[460_dir\a.txt]]] $f.text }]
        !            12:        $.[list][ ^outcome{ $l[^file:list[^taint[460_dir]]] ^l.menu{$l.name}[,] }]
        !            13:        $.[delete removes the directory][ ^outcome{ ^file:delete[^taint[460_dir\a.txt]] ^file:delete[^taint[460_dir\b.txt]] ^if(-d '460_dir'){LEFT}{removed} }]
        !            14:        $.[the slash keeps the language of the backslash: json escapes it, as it does with any tainted one][ ^apply-taint[json][^file:fullpath[^taint[<\script>.gif]]]]
        !            15:        $.[the name of a file is cut at the last separator][ ^outcome{ $f[^file::create[text;^taint[C:\a\b.txt];x]] $f.name }]
        !            16: ]
        !            17: 
        !            18: # a path scheme should not be tainted
        !            19: $report.[tainted path scheme][
        !            20:        $.[file://][ ^outcome{ ^file:fullpath[^taint[file://$root/tests/460.html]] }]
        !            21:        $.[http://][ ^outcome{ $f[^file::load[text;^taint[http://127.0.0.1:1/x]]] }]
        !            22:        $.[partly tainted][ ^outcome{ ^file:fullpath[^taint[fi]le://$root/tests/460.html] }]
        !            23:        $.[tainted after the scheme][ ^outcome{ ^file:fullpath[file://^taint[$root/tests/460.html]] }]
        !            24:        $.[as-is][ ^outcome{ ^file:fullpath[^taint[as-is][file://$root/tests/460.html]] }]
        !            25: ]
        !            26: 
        !            27: # no errors from -f, -d, find and delete with exception(false): a tainted file:// names no file
        !            28: $report.[tainted file:// without errors][
        !            29:        $.[-f of an existing file][ ^if(-f ^taint[file://$root/tests/460.html]){YES}{no}]
        !            30:        $.[-d of an existing directory][ ^if(-d ^taint[file://$root/tests]){YES}{no}]
        !            31:        $.[find of an existing file][ ^file:find[^taint[file://$root/tests/460.html]]{not found}]
        !            32:        $.[delete with exception(false) leaves the file][ ^outcome{
        !            33:                $t[text] ^t.save[460_del.txt]
        !            34:                ^file:delete[^taint[file://$root/tests/460_del.txt]][ $.exception(false) ]
        !            35:                ^if(-f '460_del.txt'){kept}{DELETED} ^file:delete[460_del.txt][ $.exception(false) ]
        !            36:        }]
        !            37: ]
        !            38: 
        !            39: # string functions keep the taint, so a scheme does not get clean on the way
        !            40: $s[^taint[file:///test.gif]]
        !            41: $report.[the scheme stays tainted through string functions][
        !            42:        $.[unescape][ ^outcome{ ^file:fullpath[^string:unescape[uri;^taint[file%3A%2F%2F%2Fx.gif]]] }]
        !            43:        $.[table cell][ ^outcome{ $t[^table::create{p^#0A$s}] ^file:fullpath[$t.p] }]
        !            44:        $.[base64 decode][ ^outcome{ $b[^s.base64[]] ^file:fullpath[^string:base64[$b]] }]
        !            45:        $.[lower][ ^outcome{ $u[^taint[FILE:///x.gif]] ^file:fullpath[^u.lower[]] }]
        !            46:        $.[replace][ ^outcome{ ^file:fullpath[^s.replace[x;y]] }]
        !            47:        $.[split and join][ ^outcome{ $l[^s.split[:]] ^file:fullpath[^l.menu{$l.piece}[:]] }]
        !            48:        $.[match][ ^outcome{ ^file:fullpath[^s.match[^^(.*)^$][]{$match.1}] }]
        !            49:        $.[hash key always tainted][ ^outcome{ $h[ $.[file:///test.gif](1) ] ^file:fullpath[^h.foreach[k;]{$k}] }]
        !            50: ]
        !            51: 
        !            52: # last, document-root change (above tests by default): set from the code, it is escaped as file names are, which leave '\' alone
        !            53: $before[^file:fullpath[x.gif]]
        !            54: $request:document-root[^taint[$root\tests]]
        !            55: $report.[document-root with a backslash][
        !            56:        $.[the backslash is kept][ $request:document-root]
        !            57:        $.[and is a separator: a relative name is inside the root][ ^outcome{ ^file:fullpath[x.gif] } vs $before before ]
        !            58: ]
        !            59: # '|' becomes _7C: a directory next to tests, 460.html is not inside it
        !            60: $request:document-root[^taint[$root|tests]]
        !            61: $report.[document-root with a char escaped in file names][
        !            62:        $.[the char is replaced][ $request:document-root]
        !            63:        $.[a relative name is outside the root][ ^outcome{ ^file:fullpath[x.gif] }]
        !            64: ]
        !            65: 
        !            66: $text[^print[$report]]
        !            67: ^taint[as-is][^text.replace[$root;<root>]]
        !            68: 
        !            69: @print[h;indent][k;v]
        !            70: ^h.foreach[k;v]{${indent}${k}:^if($v is 'hash'){^#0A^print[$v;$indent^#09]}{ ^v.trim[]^#0A}}
        !            71: 
        !            72: @outcome[code]
        !            73: ^try{
        !            74:        $result[$code]
        !            75:        $result[^result.trim[]]
        !            76: }{
        !            77:        $exception.handled(true)
        !            78:        $result[Exception: $exception.comment]
        !            79: }