Changeset 1161 for trunk/UnitTestContrib/test/unit/Fn_URLPARAM.pm

Timestamp:

12/04/08 07:48:32 (3 years ago)

Author:

KennethLavrsen

Message:

Item375: First part of addressing URLPARAM XSS issue
Additionally some docs will need some additional work.
Please test this carefully so we know which apps break from this.

File:

• trunk/UnitTestContrib/test/unit/Fn_URLPARAM.pm (modified) (3 diffs)

trunk/UnitTestContrib/test/unit/Fn_URLPARAM.pm

@@ -55 +55 @@
         '%URLPARAM{"foo" default="bar"}%', $this->{test_web}, $this->{test_topic});
     $this->assert_str_equals('', "$str");
+    
+    $this->{request}->param( -name=>'foo', -value=>'<evil script>\'\"%');
+    $str = $this->{twiki}->handleCommonTags(
+        '%URLPARAM{"foo" default="bar"}%', $this->{test_web}, $this->{test_topic});
+    $this->assert_str_equals('&#60;evil script&#62;&#39;\&#34;&#37;', "$str");
 }
 
@@ -62 +67 @@
     my $str;
 
-    $this->{request}->param( -name=>'foo', -value=>'&?*!"');
+    $this->{request}->param( -name=>'foo', -value=>'<>\'%&?*!"');
     $str = $this->{twiki}->handleCommonTags(
         '%URLPARAM{"foo" encode="entity"}%', $this->{test_web}, $this->{test_topic});
-    $this->assert_str_equals('&#38;?&#42;!&#34;', "$str");
+    $this->assert_str_equals('&#60;&#62;&#39;&#37;&#38;?&#42;!&#34;', "$str");
 
     $this->{request}->param( -name=>'foo', -value=>'&?*!" ');
@@ -76 +81 @@
         '%URLPARAM{"foo" encode="quote"}%', $this->{test_web}, $this->{test_topic});
     $this->assert_str_equals('&?*!\" ', "$str");
+    
+    $this->{request}->param( -name=>'foo', -value=>'<evil script>\'\"%');
+    $str = $this->{twiki}->handleCommonTags(
+        '%URLPARAM{"foo" default="bar" encode="safe"}%', $this->{test_web}, $this->{test_topic});
+    $this->assert_str_equals('&#60;evil script&#62;&#39;\&#34;&#37;', "$str");
+    
+    $this->{request}->param( -name=>'foo', -value=>'<evil script>\'\"%');
+    $str = $this->{twiki}->handleCommonTags(
+        '%URLPARAM{"foo" default="bar" encode="off"}%', $this->{test_web}, $this->{test_topic});
+    $this->assert_str_equals('<evil script>\'\"%', "$str");
+    
+    $this->{request}->param( -name=>'foo', -value=>'<evil script>\'\"%');
+    $str = $this->{twiki}->handleCommonTags(
+        '%URLPARAM{"foo" default="bar" encode="none"}%', $this->{test_web}, $this->{test_topic});
+    $this->assert_str_equals('<evil script>\'\"%', "$str");
 }