Return to 460.html CVS log

Up to [parser3project] / parser3 / tests

Annotation of parser3/tests/460.html, revision 1.2

1.1       moko        1: # tainting: '\' is a path separator, no longer escaped on all platforms; path schemes (file://) should not be tainted
                      2: @main[][root;text]
                      3: # the source tree root: run_parser.sh gives no DOCUMENT_ROOT, so it is PATH_TRANSLATED without PATH_INFO=/tests/460.html
                      4: $root[$request:document-root]
                      5: 
                      6: $report[^hash::create[]]
                      7: $report.[tainted backslash][
                      8:        $.[save, the whole name tainted][ ^outcome{ $s[text] ^s.save[^taint[460_dir\a.txt]] ^if(-f '460_dir/a.txt'){460_dir/a.txt}{NO FILE} }]
                      9:        $.[save, the directory tainted][ ^outcome{ $s[text] ^s.save[^taint[460_dir]\b.txt] ^if(-f '460_dir/b.txt'){460_dir/b.txt}{NO FILE} }]
                     10:        $.[-f][ ^if(-f ^taint[460_dir\a.txt]){yes}{NO}]
                     11:        $.[load][ ^outcome{ $f[^file::load[text;^taint[460_dir\a.txt]]] $f.text }]
                     12:        $.[list][ ^outcome{ $l[^file:list[^taint[460_dir]]] ^l.menu{$l.name}[,] }]
                     13:        $.[delete removes the directory][ ^outcome{ ^file:delete[^taint[460_dir\a.txt]] ^file:delete[^taint[460_dir\b.txt]] ^if(-d '460_dir'){LEFT}{removed} }]
                     14:        $.[the slash keeps the language of the backslash: json escapes it, as it does with any tainted one][ ^apply-taint[json][^file:fullpath[^taint[<\script>.gif]]]]
                     15:        $.[the name of a file is cut at the last separator][ ^outcome{ $f[^file::create[text;^taint[C:\a\b.txt];x]] $f.name }]
                     16: ]
                     17: 
                     18: # a path scheme should not be tainted
                     19: $report.[tainted path scheme][
                     20:        $.[file://][ ^outcome{ ^file:fullpath[^taint[file://$root/tests/460.html]] }]
                     21:        $.[http://][ ^outcome{ $f[^file::load[text;^taint[http://127.0.0.1:1/x]]] }]
                     22:        $.[partly tainted][ ^outcome{ ^file:fullpath[^taint[fi]le://$root/tests/460.html] }]
                     23:        $.[tainted after the scheme][ ^outcome{ ^file:fullpath[file://^taint[$root/tests/460.html]] }]
                     24:        $.[as-is][ ^outcome{ ^file:fullpath[^taint[as-is][file://$root/tests/460.html]] }]
                     25: ]
                     26: 
                     27: # no errors from -f, -d, find and delete with exception(false): a tainted file:// names no file
                     28: $report.[tainted file:// without errors][
                     29:        $.[-f of an existing file][ ^if(-f ^taint[file://$root/tests/460.html]){YES}{no}]
                     30:        $.[-d of an existing directory][ ^if(-d ^taint[file://$root/tests]){YES}{no}]
                     31:        $.[find of an existing file][ ^file:find[^taint[file://$root/tests/460.html]]{not found}]
                     32:        $.[delete with exception(false) leaves the file][ ^outcome{
                     33:                $t[text] ^t.save[460_del.txt]
                     34:                ^file:delete[^taint[file://$root/tests/460_del.txt]][ $.exception(false) ]
                     35:                ^if(-f '460_del.txt'){kept}{DELETED} ^file:delete[460_del.txt][ $.exception(false) ]
                     36:        }]
                     37: ]
                     38: 
                     39: # string functions keep the taint, so a scheme does not get clean on the way
                     40: $s[^taint[file:///test.gif]]
                     41: $report.[the scheme stays tainted through string functions][
                     42:        $.[unescape][ ^outcome{ ^file:fullpath[^string:unescape[uri;^taint[file%3A%2F%2F%2Fx.gif]]] }]
                     43:        $.[table cell][ ^outcome{ $t[^table::create{p^#0A$s}] ^file:fullpath[$t.p] }]
                     44:        $.[base64 decode][ ^outcome{ $b[^s.base64[]] ^file:fullpath[^string:base64[$b]] }]
                     45:        $.[lower][ ^outcome{ $u[^taint[FILE:///x.gif]] ^file:fullpath[^u.lower[]] }]
                     46:        $.[replace][ ^outcome{ ^file:fullpath[^s.replace[x;y]] }]
                     47:        $.[split and join][ ^outcome{ $l[^s.split[:]] ^file:fullpath[^l.menu{$l.piece}[:]] }]
                     48:        $.[match][ ^outcome{ ^file:fullpath[^s.match[^^(.*)^$][]{$match.1}] }]
                     49:        $.[hash key always tainted][ ^outcome{ $h[ $.[file:///test.gif](1) ] ^file:fullpath[^h.foreach[k;]{$k}] }]
                     50: ]
                     51: 
                     52: # last, document-root change (above tests by default): set from the code, it is escaped as file names are, which leave '\' alone
                     53: $before[^file:fullpath[x.gif]]
                     54: $request:document-root[^taint[$root\tests]]
                     55: $report.[document-root with a backslash][
                     56:        $.[the backslash is kept][ $request:document-root]
                     57:        $.[and is a separator: a relative name is inside the root][ ^outcome{ ^file:fullpath[x.gif] } vs $before before ]
1.2     ! moko       58:        $.[diskpath of a web path][ ^file:diskpath[/x.gif]]
        !            59:        $.[diskpath of file://][ ^file:diskpath[file://$root/tests/x.gif]]
1.1       moko       60: ]
                     61: # '|' becomes _7C: a directory next to tests, 460.html is not inside it
                     62: $request:document-root[^taint[$root|tests]]
                     63: $report.[document-root with a char escaped in file names][
                     64:        $.[the char is replaced][ $request:document-root]
                     65:        $.[a relative name is outside the root][ ^outcome{ ^file:fullpath[x.gif] }]
1.2     ! moko       66:        $.[diskpath of a web path][ ^file:diskpath[/x.gif]]
1.1       moko       67: ]
                     68: 
                     69: $text[^print[$report]]
                     70: ^taint[as-is][^text.replace[$root;<root>]]
                     71: 
                     72: @print[h;indent][k;v]
                     73: ^h.foreach[k;v]{${indent}${k}:^if($v is 'hash'){^#0A^print[$v;$indent^#09]}{ ^v.trim[]^#0A}}
                     74: 
                     75: @outcome[code]
                     76: ^try{
                     77:        $result[$code]
                     78:        $result[^result.trim[]]
                     79: }{
                     80:        $exception.handled(true)
                     81:        $result[Exception: $exception.comment]
                     82: }