diff options
| author | Meik Sievertsen <acydburn@phpbb.com> | 2008-06-03 16:15:01 +0000 |
|---|---|---|
| committer | Meik Sievertsen <acydburn@phpbb.com> | 2008-06-03 16:15:01 +0000 |
| commit | 7591a84c0d66a64fb0ec2b77f785f7e83088ceaf (patch) | |
| tree | 9c8441e1da458aba5b2f21add8487d355ad63c61 /tests/security/extract_current_page.php | |
| parent | 990e3cd4b286e5ae71b967b97eade303cca5cb31 (diff) | |
| download | forums-7591a84c0d66a64fb0ec2b77f785f7e83088ceaf.tar forums-7591a84c0d66a64fb0ec2b77f785f7e83088ceaf.tar.gz forums-7591a84c0d66a64fb0ec2b77f785f7e83088ceaf.tar.bz2 forums-7591a84c0d66a64fb0ec2b77f785f7e83088ceaf.tar.xz forums-7591a84c0d66a64fb0ec2b77f785f7e83088ceaf.zip | |
two new tests, added security suite and fixed utf8 tests.
git-svn-id: file:///svn/phpbb/trunk@8584 89ea8834-ac86-4346-8a33-228a782c2dd0
Diffstat (limited to 'tests/security/extract_current_page.php')
| -rw-r--r-- | tests/security/extract_current_page.php | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/tests/security/extract_current_page.php b/tests/security/extract_current_page.php new file mode 100644 index 0000000000..4048a6303c --- /dev/null +++ b/tests/security/extract_current_page.php @@ -0,0 +1,57 @@ +<?php +/** +* +* @package testing +* @version $Id: request_var.php 8549 2008-05-04 22:54:16Z naderman $ +* @copyright (c) 2008 phpBB Group +* @license http://opensource.org/licenses/gpl-license.php GNU Public License +* +*/ + +define('IN_PHPBB', true); + +require_once 'PHPUnit/Framework.php'; + +require_once '../phpBB/includes/functions.php'; +require_once '../phpBB/includes/session.php'; + +class phpbb_security_extract_current_page_test extends PHPUnit_Framework_TestCase +{ + public static function security_variables() + { + return array( + array('http://localhost/phpBB/index.php', 'mark=forums&x="><script>alert(/XSS/);</script>', 'mark=forums&x=%22%3E%3Cscript%3Ealert(/XSS/);%3C/script%3E'), + array('http://localhost/phpBB/index.php', 'mark=forums&x=%22%3E%3Cscript%3Ealert(/XSS/);%3C/script%3E', 'mark=forums&x=%22%3E%3Cscript%3Ealert(/XSS/);%3C/script%3E'), + ); + } + + /** + * @dataProvider security_variables + */ + public function test_query_string_php_self($url, $query_string, $expected) + { + $_SERVER['PHP_SELF'] = $url; + $_SERVER['QUERY_STRING'] = $query_string; + + $result = session::extract_current_page('./'); + + $label = 'Running extract_current_page on ' . $query_string . ' with PHP_SELF filled.'; + $this->assertEquals($expected, $result['query_string'], $label); + } + + /** + * @dataProvider security_variables + */ + public function test_query_string_request_uri($url, $query_string, $expected) + { + $_SERVER['REQUEST_URI'] = $url . '?' . $query_string; + $_SERVER['QUERY_STRING'] = $query_string; + + $result = session::extract_current_page('./'); + + $label = 'Running extract_current_page on ' . $query_string . ' with REQUEST_URI filled.'; + $this->assertEquals($expected, $result['query_string'], $label); + } +} + +?>
\ No newline at end of file |