/
vshmidt
/
php
Обзор
Документация
Войти
/
vshmidt
/
php
Код
Запросы
0
Задачи
Вики
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
ext/libxml/tests/bug61367-read_2.phpt
63 строки
1 KB
Niels Dossche
Update error message for libxml 2.13
13 сен 2024, 00:06
13 сен 2024, 00:06
3ec5919
Код
Авторство
О чём код?
--TEST-- Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test --EXTENSIONS-- dom --SKIPIF-- <?php if (LIBXML_VERSION < 20912) die('skip For libxml2 >= 2.9.12 only'); ?> --INI-- open_basedir=. --FILE-- <?php /* * Note: Using error_reporting=E_ALL & ~E_NOTICE to suppress "Trying to get property of non-object" notices. */ class StreamExploiter { public $context; public function stream_close ( ) { $doc = new DOMDocument; $doc->resolveExternals = true; $doc->substituteEntities = true; $dir = htmlspecialchars(dirname(getcwd())); $dir = str_replace('\\', '/', $dir); // fix for windows $doc->loadXML( <<<XML <!DOCTYPE doc [ <!ENTITY file SYSTEM "file:///$dir/bad"> ]> <doc>&file;</doc> XML ); print $doc->documentElement->firstChild->nodeValue; } public function stream_open ( $path , $mode , $options , &$opened_path ) { return true; } } var_dump(mkdir('test_bug_61367-read')); var_dump(mkdir('test_bug_61367-read/base')); var_dump(file_put_contents('test_bug_61367-read/bad', 'blah')); var_dump(chdir('test_bug_61367-read/base')); stream_wrapper_register( 'exploit', 'StreamExploiter' ); $s = fopen( 'exploit://', 'r' ); ?> --CLEAN-- <?php unlink('test_bug_61367-read/bad'); rmdir('test_bug_61367-read/base'); rmdir('test_bug_61367-read'); ?> --EXPECTF-- bool(true) bool(true) int(4) bool(true) %s: DOMDocument::loadXML(): %Sfailed to load %s Warning: Attempt to read property "nodeValue" on null in %s on line %d