smarty-php/smarty
1
0
Fork 0
mirror of https://github.com/smarty-php/smarty.git synced 2026-05-04 11:44:16 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-4h9c-v5vg-5m6m

Browse Source 
* Prevent evasion of the static_classes security policy.

* Updated deprecated exception expectations.
This commit is contained in:
Simon Wisselink
2022-01-10 10:48:27 +01:00
committed by GitHub
parent baad3115cd
commit 19ae410bf5
4 changed files with 38 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/UnitTests/SecurityTests/SecurityTest.php
+29 -7
View File
@@ -257,19 +257,41 @@ class SecurityTest extends PHPUnit_Smarty
$this->assertEquals('25', $this->smarty->fetch($tpl));
}
/**
* test not trusted PHP function
* @runInSeparateProcess
* @preserveGlobalState disabled
*/
public function testNotTrustedStaticClass()
{
/**
* test not trusted PHP function
* @runInSeparateProcess
* @preserveGlobalState disabled
*/
public function testNotTrustedStaticClass()
{
$this->expectException('SmartyException');
$this->expectExceptionMessage('access to static class \'mysecuritystaticclass\' not allowed by security setting');
$this->smarty->security_policy->static_classes = array('null');
$this->smarty->fetch('string:{mysecuritystaticclass::square(5)}');
}
/**
* test not trusted PHP function
*/
public function testNotTrustedStaticClassEval()
{
$this->expectException('SmartyException');
$this->expectExceptionMessage('dynamic static class not allowed by security setting');
$this->smarty->security_policy->static_classes = array('null');
$this->smarty->fetch('string:{$test = "mysecuritystaticclass"}{$test::square(5)}');
}
/**
* test not trusted PHP function
*/
public function testNotTrustedStaticClassSmartyVar()
{
$this->expectException('SmartyException');
$this->expectExceptionMessage('dynamic static class not allowed by security setting');
$this->smarty->security_policy->static_classes = array('null');
$this->smarty->fetch('string:{$smarty.template_object::square(5)}');
}
public function testChangedTrustedDirectory()
{
$this->smarty->security_policy->secure_dir = array(