73e08353fb
In practise this probably doesn't matter, since template names are not user controlled, and php isn't stupid enough to fall for tricks with nulls (afaict). Nonetheless, the code from Title is only meant to prevent url traversal, it is not meant to prevent file system path traversal. Change-Id: Id690576326d03744acc8fbbe78f4b7a4b4c04d7e
112 lines
1.8 KiB
PHP
112 lines
1.8 KiB
PHP
<?php
|
|
|
|
/**
|
|
* @group Templates
|
|
*/
|
|
class TemplateParserTest extends MediaWikiTestCase {
|
|
|
|
protected $templateDir;
|
|
|
|
protected function setUp() {
|
|
parent::setUp();
|
|
|
|
$this->setMwGlobals( [
|
|
'wgSecretKey' => 'foo',
|
|
] );
|
|
|
|
$this->templateDir = dirname( __DIR__ ) . '/data/templates/';
|
|
}
|
|
|
|
/**
|
|
* @dataProvider provideProcessTemplate
|
|
* @covers TemplateParser::processTemplate
|
|
* @covers TemplateParser::getTemplate
|
|
* @covers TemplateParser::getTemplateFilename
|
|
*/
|
|
public function testProcessTemplate( $name, $args, $result, $exception = false ) {
|
|
if ( $exception ) {
|
|
$this->setExpectedException( $exception );
|
|
}
|
|
$tp = new TemplateParser( $this->templateDir );
|
|
$this->assertEquals( $result, $tp->processTemplate( $name, $args ) );
|
|
}
|
|
|
|
public static function provideProcessTemplate() {
|
|
return [
|
|
[
|
|
'foobar',
|
|
[],
|
|
"hello world!\n"
|
|
],
|
|
[
|
|
'foobar_args',
|
|
[
|
|
'planet' => 'world',
|
|
],
|
|
"hello world!\n",
|
|
],
|
|
[
|
|
'../foobar',
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
"\000../foobar",
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
'/',
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
// Allegedly this can strip ext in windows.
|
|
'baz<',
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
'\\foo',
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
'C:\bar',
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
"foo\000bar",
|
|
[],
|
|
false,
|
|
'UnexpectedValueException'
|
|
],
|
|
[
|
|
'nonexistenttemplate',
|
|
[],
|
|
false,
|
|
'RuntimeException',
|
|
],
|
|
[
|
|
'has_partial',
|
|
[
|
|
'planet' => 'world',
|
|
],
|
|
"Partial hello world!\n in here\n",
|
|
],
|
|
[
|
|
'bad_partial',
|
|
[],
|
|
false,
|
|
'Exception',
|
|
],
|
|
];
|
|
}
|
|
}
|