From 5bbc4e083eb6969de91c263206dbe44b850585af Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Tue, 4 Jun 2024 14:06:35 +0200 Subject: [PATCH] Add a phpunit test --- htdocs/core/lib/functions.lib.php | 4 ++-- test/phpunit/SecurityTest.php | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index a6c1a383d67..e8bbde768af 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -10126,7 +10126,7 @@ function isStringVarMatching($var, $regextext, $matchrule = 1) /** * Verify if condition in string is ok or not * - * @param string $strToEvaluate String with condition to check + * @param string $strToEvaluate String with condition to check * @param string $onlysimplestring '0' (deprecated, do not use it anymore)=Accept all chars, * '1' (most common use)=Accept only simple string with char 'a-z0-9\s^$_+-.*>&|=!?():"\',/@';', * '2' (used for example for the compute property of extrafields)=Accept also '[]' @@ -10156,7 +10156,7 @@ function verifCond($strToEvaluate, $onlysimplestring = '1') * @param string $onlysimplestring '0' (deprecated, do not use it anymore)=Accept all chars, * '1' (most common use)=Accept only simple string with char 'a-z0-9\s^$_+-.*>&|=!?():"\',/@';', * '2' (used for example for the compute property of extrafields)=Accept also '[]' - * @return void|string Nothing or return result of eval (even if type can be int, it is safer to assume string and find all potential typing issues as abs(dol_eval(...)). + * @return void|string Nothing or return result of eval (even if type can be int, it is safer to assume string and find all potential typing issues as abs(dol_eval(...)). * @see verifCond() * @phan-suppress PhanPluginUnsafeEval */ diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php index 79b82b3e1cd..5036f535367 100644 --- a/test/phpunit/SecurityTest.php +++ b/test/phpunit/SecurityTest.php @@ -1108,6 +1108,10 @@ class SecurityTest extends CommonClassTest $result = (string) dol_eval('$leftmenu(-5)', 1, 0); print "result20 = ".$result."\n"; $this->assertStringContainsString('Bad string syntax to evaluate', $result); + + $result = (string) dol_eval('str_replace("z","e","zxzc")("whoami");', 1, 0); + print "result21 = ".$result."\n"; + $this->assertStringContainsString('Bad string syntax to evaluate', $result); } /**