geckon01/Twig
1
0
Fork 0
mirror of https://github.com/twigphp/Twig.git synced 2026-09-13 02:46:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed possible security problems with NUL bytes

Browse Source
This commit is contained in:
Fabien Potencier
2011-06-17 09:17:45 +02:00
parent 2c26e6776b
commit 027f4890a7
4 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/Twig/Autoloader.php
+1 -1
View File
@@ -39,7 +39,7 @@ class Twig_Autoloader
return;
}
if (file_exists($file = dirname(__FILE__).'/../'.str_replace('_', '/', $class).'.php')) {
if (file_exists($file = dirname(__FILE__).'/../'.str_replace(array('_', "\0"), array('/', ''), $class).'.php')) {
require $file;
}
}
lib/Twig/Compiler.php
+1 -1
View File
@@ -129,7 +129,7 @@ class Twig_Compiler implements Twig_CompilerInterface
*/
public function string($value)
{
$this->source .= sprintf('"%s"', addcslashes($value, "\t\"\$\\"));
$this->source .= sprintf('"%s"', addcslashes($value, "\0\t\"\$\\"));
return $this;
}
lib/Twig/Loader/Filesystem.php
+4
View File
@@ -131,6 +131,10 @@ class Twig_Loader_Filesystem implements Twig_LoaderInterface
protected function validateName($name)
{
if (false !== strpos($name, "\0")) {
throw new Twig_Error_Loader('A template name cannot contain NUL bytes.');
}
$parts = explode('/', $name);
$level = 0;
foreach ($parts as $part) {
test/Twig/Tests/Loader/FilesystemTest.php
+8 -2
View File
@@ -13,17 +13,23 @@ class Twig_Tests_Loader_FilesystemTest extends PHPUnit_Framework_TestCase
{
/**
* @dataProvider getSecurityTests
* @expectedException Twig_Error_Loader
*/
public function testSecurity($template)
{
$loader = new Twig_Loader_Filesystem(array(__DIR__.'/../Fixtures'));
$loader->getCacheKey($template);
try {
$loader->getCacheKey($template);
$this->fail();
} catch (Twig_Error_Loader $e) {
$this->assertNotContains('Unable to find template', $e->getMessage());
}
}
public function getSecurityTests()
{
return array(
array("AutoloaderTest\0.php"),
array('..\\AutoloaderTest.php'),
array('..\\\\\\AutoloaderTest.php'),
array('../AutoloaderTest.php'),