diff options
| -rw-r--r-- | t/002goodperl.t | 33 |
1 files changed, 32 insertions, 1 deletions
diff --git a/t/002goodperl.t b/t/002goodperl.t index e95870d70..d1858361f 100644 --- a/t/002goodperl.t +++ b/t/002goodperl.t @@ -19,7 +19,7 @@ use lib 't'; use Support::Files; use Test::More tests => (scalar(@Support::Files::testitems) - + scalar(@Support::Files::test_files)) * 5; + + scalar(@Support::Files::test_files)) * 6; my @testitems = (@Support::Files::test_files, @Support::Files::testitems); my @require_taint = qw(email_in.pl importxml.pl mod_perl.pl whine.pl); @@ -139,4 +139,35 @@ foreach my $file (@testitems) { close(FILE); } + +# Forbird the { foo => $cgi->param() } syntax, for security reasons. +foreach my $file (@testitems) { + $file =~ s/\s.*$//; # nuke everything after the first space (#comment) + next unless $file; # skip null entries + if (!open(FILE, $file)) { + ok(0, "could not open $file --WARNING"); + next; + } + my $lineno = 0; + my @unsafe_args; + + while (my $file_line = <FILE>) { + $lineno++; + $file_line =~ s/^\s*(.+)\s*$/$1/; # Remove leading and trailing whitespaces. + if ($file_line =~ /^[^#]+=> \$cgi\->param/) { + push(@unsafe_args, "$file_line on line $lineno"); + } + } + + if (@unsafe_args) { + ok(0, "$file incorrectly passes a CGI argument to a hash --ERROR\n" . + join("\n", @unsafe_args)); + } + else { + ok(1, "$file has no vulnerable hash syntax"); + } + + close(FILE); +} + exit 0; |