mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-09-22 10:45:03 -04:00
jekkos
47aade5024
* fix(locale): validate language_code against known locales to block path traversal postSaveLocale() stored language_code from user input with no allow-list validation, and it later flows into Language::setLocale()/load() where the locale segment is require()'d. An authenticated config-grant account could store a relative path (e.g. ../../public/uploads) and, combined with a planted file in public/uploads/, achieve unauthenticated RCE on the next request. Validate the submitted language against array_keys(get_languages()) before storing, and harden languageExists() to reject path separators and dot-dot sequences. Adds regression tests. * test(locale): give locale fixture valid reference-code min/max defaults * fix(locale): reject null bytes in languageExists guard A stored language_code containing a NUL byte passes the existing path-separator and parent-dir checks, then reaches file_exists(). On PHP 8.5+ file_exists() throws a ValueError for NUL-byte paths, which breaks configuration loading. Reject NUL bytes in the guard and add regression tests.
50 lines
1.3 KiB
PHP
50 lines
1.3 KiB
PHP
<?php
|
|
|
|
namespace Tests\Events;
|
|
|
|
use App\Events\Load_config;
|
|
use CodeIgniter\Test\CIUnitTestCase;
|
|
use ReflectionMethod;
|
|
|
|
class Load_configTest extends CIUnitTestCase
|
|
{
|
|
private function languageExists(string $languageCode): bool
|
|
{
|
|
$instance = new Load_config();
|
|
$method = new ReflectionMethod(Load_config::class, 'languageExists');
|
|
$method->setAccessible(true);
|
|
|
|
return (bool) $method->invoke($instance, $languageCode);
|
|
}
|
|
|
|
public function testLanguageExistsAcceptsValidCode(): void
|
|
{
|
|
$this->assertTrue($this->languageExists('en'));
|
|
}
|
|
|
|
public function testLanguageExistsRejectsNullByte(): void
|
|
{
|
|
$this->assertFalse($this->languageExists("en\0"));
|
|
}
|
|
|
|
public function testLanguageExistsRejectsNullByteOnly(): void
|
|
{
|
|
$this->assertFalse($this->languageExists("\0"));
|
|
}
|
|
|
|
public function testLanguageExistsRejectsForwardSlashPath(): void
|
|
{
|
|
$this->assertFalse($this->languageExists('en/../../etc/passwd'));
|
|
}
|
|
|
|
public function testLanguageExistsRejectsBackslashPath(): void
|
|
{
|
|
$this->assertFalse($this->languageExists('..\..\etc\passwd'));
|
|
}
|
|
|
|
public function testLanguageExistsRejectsParentDir(): void
|
|
{
|
|
$this->assertFalse($this->languageExists('..'));
|
|
}
|
|
}
|