Arbit - project tracking

Dwoo

Browse source code

File: / tests/ SecurityTests.php

Type
text/plain text/plain
Last Author
seldaek
Version
0640791741c71faeecec2d87c7e444b0dd500cc2
Line Rev. Author Source
1 dc33f4 Seldaek <?php
2 ↓ Seldaek
3 dd288f Seldaek require_once DWOO_DIRECTORY . 'Dwoo/Compiler.php';
4 dc33f4 Seldaek
5 ↓ Seldaek class SecurityTests extends PHPUnit_Framework_TestCase
6 ↓ Seldaek {
7 ↓ Seldaek protected $compiler;
8 ↓ Seldaek protected $dwoo;
9 ↓ Seldaek protected $policy;
10 ↓ Seldaek
11 ↓ Seldaek public function __construct()
12 ↓ Seldaek {
13 9cf6ad Seldaek $this->compiler = new Dwoo_Compiler();
14 9315dc seldaek $this->dwoo = new Dwoo_Core(DWOO_COMPILE_DIR, DWOO_CACHE_DIR);
15 9cf6ad Seldaek $this->policy = new Dwoo_Security_Policy();
16 dc33f4 Seldaek $this->dwoo->setSecurityPolicy($this->policy);
17 ↓ Seldaek }
18 ↓ Seldaek
19 ↓ Seldaek public function testConstantHandling()
20 ↓ Seldaek {
21 9cf6ad Seldaek $tpl = new Dwoo_Template_String('{$dwoo.const.DWOO_DIRECTORY}');
22 dc33f4 Seldaek $tpl->forceCompilation();
23 ↓ Seldaek
24 ↓ Seldaek $this->assertEquals("", $this->dwoo->get($tpl, array(), $this->compiler));
25 ↓ Seldaek
26 9cf6ad Seldaek $this->policy->setConstantHandling(Dwoo_Security_Policy::CONST_ALLOW);
27 dc33f4 Seldaek
28 9cf6ad Seldaek $tpl = new Dwoo_Template_String('{$dwoo.const.DWOO_DIRECTORY}');
29 dc33f4 Seldaek $tpl->forceCompilation();
30 ↓ Seldaek
31 ↓ Seldaek $this->assertEquals(DWOO_DIRECTORY, $this->dwoo->get($tpl, array(), $this->compiler));
32 ↓ Seldaek }
33 ↓ Seldaek
34 ↓ Seldaek public function testPhpHandling()
35 ↓ Seldaek {
36 9cf6ad Seldaek $this->policy->setPhpHandling(Dwoo_Security_Policy::PHP_ALLOW);
37 dc33f4 Seldaek
38 9cf6ad Seldaek $tpl = new Dwoo_Template_String('<?php echo "moo"; ?>');
39 dc33f4 Seldaek $tpl->forceCompilation();
40 ↓ Seldaek
41 ↓ Seldaek $this->assertEquals("moo", $this->dwoo->get($tpl, array(), $this->compiler));
42 ↓ Seldaek
43 ↓ Seldaek
44 9cf6ad Seldaek $this->policy->setPhpHandling(Dwoo_Security_Policy::PHP_ENCODE);
45 dc33f4 Seldaek
46 9cf6ad Seldaek $tpl = new Dwoo_Template_String('<?php echo "moo"; ?>');
47 dc33f4 Seldaek $tpl->forceCompilation();
48 ↓ Seldaek
49 ↓ Seldaek $this->assertEquals(htmlspecialchars('<?php echo "moo"; ?>'), $this->dwoo->get($tpl, array(), $this->compiler));
50 ↓ Seldaek
51 ↓ Seldaek
52 9cf6ad Seldaek $this->policy->setPhpHandling(Dwoo_Security_Policy::PHP_REMOVE);
53 dc33f4 Seldaek
54 9cf6ad Seldaek $tpl = new Dwoo_Template_String('<?php echo "moo"; ?>');
55 dc33f4 Seldaek $tpl->forceCompilation();
56 ↓ Seldaek
57 ↓ Seldaek $this->assertEquals('', $this->dwoo->get($tpl, array(), $this->compiler));
58 ↓ Seldaek }
59 ↓ Seldaek
60 ↓ Seldaek public function testAllowPhpFunction()
61 ↓ Seldaek {
62 ↓ Seldaek $this->policy->allowPhpFunction('testphpfunc');
63 ↓ Seldaek
64 9cf6ad Seldaek $tpl = new Dwoo_Template_String('{testphpfunc("foo")}');
65 dc33f4 Seldaek $tpl->forceCompilation();
66 ↓ Seldaek
67 ↓ Seldaek $this->assertEquals("fooOK", $this->dwoo->get($tpl, array(), $this->compiler));
68 064079 seldaek
69 ↓ seldaek $this->policy->disallowPhpFunction('testphpfunc');
70 dc33f4 Seldaek }
71 ↓ Seldaek
72 a91a53 seldaek /**
73 064079 seldaek * @expectedException Dwoo_Security_Exception
74 a91a53 seldaek */
75 ↓ seldaek public function testNotAllowedPhpFunction()
76 ↓ seldaek {
77 064079 seldaek $tpl = new Dwoo_Template_String('{testphpfunc("foo")}');
78 ↓ seldaek $tpl->forceCompilation();
79 ↓ seldaek
80 ↓ seldaek $this->dwoo->get($tpl, array(), $this->compiler);
81 ↓ seldaek }
82 ↓ seldaek
83 ↓ seldaek public function testAllowMethod()
84 ↓ seldaek {
85 ↓ seldaek $this->policy->allowMethod('testSecurityClass','testOK');
86 ↓ seldaek
87 ↓ seldaek $tpl = new Dwoo_Template_String('{$obj->testOK("foo")}');
88 ↓ seldaek $tpl->forceCompilation();
89 ↓ seldaek
90 ↓ seldaek $this->assertEquals("fooOK", $this->dwoo->get($tpl, array('obj' => new testSecurityClass), $this->compiler));
91 ↓ seldaek
92 ↓ seldaek $this->policy->disallowMethod('testSecurityClass','test');
93 ↓ seldaek }
94 ↓ seldaek
95 ↓ seldaek /**
96 ↓ seldaek * @expectedException PHPUnit_Framework_Error
97 ↓ seldaek */
98 ↓ seldaek public function testNotAllowedMethod()
99 ↓ seldaek {
100 ↓ seldaek $tpl = new Dwoo_Template_String('{$obj->testOK("foo")}');
101 ↓ seldaek $tpl->forceCompilation();
102 ↓ seldaek
103 ↓ seldaek $this->dwoo->get($tpl, array('obj' => new testSecurityClass), $this->compiler);
104 ↓ seldaek }
105 ↓ seldaek
106 ↓ seldaek public function testAllowStaticMethod()
107 ↓ seldaek {
108 ↓ seldaek $this->policy->allowMethod('testSecurityClass','testStatic');
109 ↓ seldaek
110 ↓ seldaek $tpl = new Dwoo_Template_String('{testSecurityClass::testStatic("foo")}');
111 ↓ seldaek $tpl->forceCompilation();
112 ↓ seldaek
113 ↓ seldaek $this->assertEquals("fooOK", $this->dwoo->get($tpl, array(), $this->compiler));
114 ↓ seldaek
115 ↓ seldaek $this->policy->disallowMethod('testSecurityClass','testStatic');
116 ↓ seldaek }
117 ↓ seldaek
118 ↓ seldaek /**
119 ↓ seldaek * @expectedException Dwoo_Security_Exception
120 ↓ seldaek */
121 ↓ seldaek public function testNotAllowedStaticMethod()
122 ↓ seldaek {
123 ↓ seldaek $tpl = new Dwoo_Template_String('{testSecurityClass::testStatic("foo")}');
124 a91a53 seldaek $tpl->forceCompilation();
125 ↓ seldaek
126 ↓ seldaek $this->dwoo->get($tpl, array(), $this->compiler);
127 ↓ seldaek }
128 ↓ seldaek
129 064079 seldaek /**
130 ↓ seldaek * @expectedException Dwoo_Security_Exception
131 ↓ seldaek */
132 ↓ seldaek public function testNotAllowedSubExecution()
133 ↓ seldaek {
134 ↓ seldaek $tpl = new Dwoo_Template_String('{$obj->test(preg_replace_callback("{.}", "mail", "f"))}');
135 ↓ seldaek $tpl->forceCompilation();
136 ↓ seldaek
137 ↓ seldaek $this->dwoo->get($tpl, array('obj' => new testSecurityClass), $this->compiler);
138 ↓ seldaek }
139 ↓ seldaek
140 dc33f4 Seldaek public function testAllowDirectoryGetSet()
141 ↓ Seldaek {
142 ↓ Seldaek $old = $this->policy->getAllowedDirectories();
143 2f0eff Seldaek $this->policy->allowDirectory(array('./resources'));
144 ↓ Seldaek $this->policy->allowDirectory('./temp');
145 ↓ Seldaek $this->assertEquals(array_merge($old, array(realpath('./resources')=>true, realpath('./temp')=>true)), $this->policy->getAllowedDirectories());
146 ↓ Seldaek
147 dc33f4 Seldaek $this->policy->disallowDirectory(array('./resources'));
148 2f0eff Seldaek $this->policy->disallowDirectory('./temp');
149 ↓ Seldaek $this->assertEquals($old, $this->policy->getAllowedDirectories());
150 dc33f4 Seldaek }
151 2f0eff Seldaek
152 dc33f4 Seldaek public function testAllowPhpGetSet()
153 ↓ Seldaek {
154 ↓ Seldaek $old = $this->policy->getAllowedPhpFunctions();
155 2f0eff Seldaek $this->policy->allowPhpFunction(array('a','b'));
156 ↓ Seldaek $this->policy->allowPhpFunction('c');
157 ↓ Seldaek $this->assertEquals(array_merge($old, array('a'=>true, 'b'=>true, 'c'=>true)), $this->policy->getAllowedPhpFunctions());
158 ↓ Seldaek
159 ↓ Seldaek $this->policy->disallowPhpFunction(array('a', 'b'));
160 ↓ Seldaek $this->policy->disallowPhpFunction('c');
161 ↓ Seldaek $this->assertEquals($old, $this->policy->getAllowedPhpFunctions());
162 dc33f4 Seldaek }
163 ↓ Seldaek }
164 064079 seldaek
165 ↓ seldaek function testphpfunc($input) { return $input.'OK'; }
166 ↓ seldaek
167 ↓ seldaek class testSecurityClass {
168 ↓ seldaek public static function testStatic($input) {
169 ↓ seldaek return $input.'OK';
170 ↓ seldaek }
171 ↓ seldaek
172 ↓ seldaek public function testOK($input) {
173 ↓ seldaek return $input.'OK';
174 ↓ seldaek }
175 ↓ seldaek
176 ↓ seldaek public function test($input) {
177 ↓ seldaek throw new Exception('can not call');
178 ↓ seldaek }
179 ↓ seldaek }

Arbit - project tracking, licensed under GPL 3