gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 24756: Fix failing tests by removing temporary filenames 

In order to resolve the random failure, that might be caused by reusing
filenames in File::Temp and caching xslt code, this patch replaces the
temporary file by using the code parameter.

Note: Since XSLT uses a digest based on the passed code fragment, we will
exclude collisions here.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This commit is contained in:
Marcel de Rooy 2020-02-28 11:13:16 +00:00 committed by Martin Renvoize
parent 2c8a117604
commit e1ea21415e
No known key found for this signature in database
GPG Key ID: 422B469130441A0F
1 changed files with 9 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
t/db_dependent/Koha/XSLT/Security.t
View File

@ -39,14 +39,12 @@ my $xslt=<<"EOT";
</xsl:template>
</xsl:stylesheet>
EOT
my $xslt_file = mytempfile($xslt);
my $output= $engine->transform( "<ignored/>", $xslt_file );
my $output= $engine->transform({ xml => "<ignored/>", code => $xslt });
like($output, qr/Big secret/, 'external entity got through');
t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
$engine=Koha::XSLT::Base->new;
$output= $engine->transform( "<ignored/>", $xslt_file );
$output= $engine->transform({ xml => "<ignored/>", code => $xslt });
unlike($output, qr/Big secret/, 'external entity did not get through');
# Adding a document call to trigger callback for read_file
@ -59,8 +57,7 @@ $xslt=<<"EOT";
</xsl:template>
</xsl:stylesheet>
EOT
$xslt_file = mytempfile($xslt);
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
[ qr/read_file called in XML::LibXSLT/, qr/runtime error/ ],
'Triggered security callback for read_file';
@ -73,8 +70,7 @@ $xslt=<<"EOT";
</xsl:template>
</xsl:stylesheet>
EOT
$xslt_file = mytempfile($xslt);
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
[ qr/write_file called in XML::LibXSLT/, qr/runtime error/ ],
'Triggered security callback for write_file';
@ -87,8 +83,7 @@ $xslt=<<"EOT";
</xsl:template>
</xsl:stylesheet>
EOT
$xslt_file = mytempfile($xslt);
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
[ qr/read_net called in XML::LibXSLT/, qr/runtime error/ ],
'Triggered security callback for read_net';
@ -103,8 +98,7 @@ $xslt=<<"EOT";
</xsl:template>
</xsl:stylesheet>
EOT
$xslt_file = mytempfile($xslt);
warnings_like { $output= $engine->transform( "<ignored/>", $xslt_file ); }
warnings_like { $output= $engine->transform({ xml => "<ignored/>", code => $xslt }); }
[ qr/write_net called in XML::LibXSLT/, qr/runtime error/ ],
'Triggered security callback for write_net';
@ -118,19 +112,18 @@ $xslt=<<"EOT";
<xsl:template match="/"/>
</xsl:stylesheet>
EOT
$xslt_file = mytempfile($xslt);
$engine->print_warns(1);
{
my @warn;
local $SIG{__WARN__} = sub { push @warn, $_[0]; };
$output= $engine->transform( "<ignored/>", $xslt_file );
$output= $engine->transform({ xml => "<ignored/>", code => $xslt });
is( ( grep { /failed to load external/ } @warn ), 1, 'Expected import error' );
is( ( grep { /read_net/ } @warn ), 0, 'No read_net warn for remote import' );
}
sub mytempfile {
my ( $fh, $fn ) = tempfile( SUFFIX => '.xsl', UNLINK => 1 );
print $fh $_[0]//'';
my ($fh, $fn) = tempfile( UNLINK => 1 );
print $fh $_[0] if $_[0];
close $fh;
return $fn;
}