Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add a phpunit test

Browse Source
This commit is contained in:
Laurent Destailleur 2024-06-04 14:06:35 +02:00
parent 46a7013713
commit 5bbc4e083e
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
htdocs/core/lib/functions.lib.php
View File

@ -10126,7 +10126,7 @@ function isStringVarMatching($var, $regextext, $matchrule = 1)
/**
* Verify if condition in string is ok or not
*
* @param string $strToEvaluate String with condition to check
* @param string $strToEvaluate String with condition to check
* @param string $onlysimplestring '0' (deprecated, do not use it anymore)=Accept all chars,
* '1' (most common use)=Accept only simple string with char 'a-z0-9\s^$_+-.*>&|=!?():"\',/@';',
* '2' (used for example for the compute property of extrafields)=Accept also '[]'
@ -10156,7 +10156,7 @@ function verifCond($strToEvaluate, $onlysimplestring = '1')
* @param string $onlysimplestring '0' (deprecated, do not use it anymore)=Accept all chars,
* '1' (most common use)=Accept only simple string with char 'a-z0-9\s^$_+-.*>&|=!?():"\',/@';',
* '2' (used for example for the compute property of extrafields)=Accept also '[]'
* @return void|string Nothing or return result of eval (even if type can be int, it is safer to assume string and find all potential typing issues as abs(dol_eval(...)).
* @return void|string Nothing or return result of eval (even if type can be int, it is safer to assume string and find all potential typing issues as abs(dol_eval(...)).
* @see verifCond()
* @phan-suppress PhanPluginUnsafeEval
*/

4
test/phpunit/SecurityTest.php
View File

@ -1108,6 +1108,10 @@ class SecurityTest extends CommonClassTest
$result = (string) dol_eval('$leftmenu(-5)', 1, 0);
print "result20 = ".$result."\n";
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
$result = (string) dol_eval('str_replace("z","e","zxzc")("whoami");', 1, 0);
print "result21 = ".$result."\n";
$this->assertStringContainsString('Bad string syntax to evaluate', $result);
}
/**