← Back to branch summary

~yolanda.robla/ubuntu/saucy/nagios3/dep-8-tests

« back to all changes in this revision

Viewing changes to t/618cgisecurity.t

  • Committer: Package Import Robot
  • Author(s): Alexander Wirt
  • Date: 2012-06-16 09:05:19 UTC
  • mfrom: (1.1.7)
  • Revision ID: package-import@ubuntu.com-20120616090519-ne14zejkhhyboolc
Tags: 3.4.1-1
http://bugs.debian.org/662441
http://bugs.debian.org/654855
http://bugs.debian.org/626854
* [28e077b] Imported Upstream version 3.3.1
* [d5314e0] don't call updatepo in clean target
* [45b3eb9] Don't remove config foo
* [54e3dff] Don't fix permissions in cgi postinst
* [d7be9db] Build-depend on libpng-dev (Closes: #662441)
* [4c47006] Add dutch po translation (Closes: #654855)
* [2b6573b] Refresh 10_p1_pl_shebang.dpatch
* [316fd7a] Update 40_fix_spurious_dollar_signs_added_to_command_lines
* [5ff2780] Refresh 55_strip_logarchivepath.dpatch
* [811d269] Refresh 60_fix_p1.pl_patch_mini_epn.dpatch
* [39a1e9c] Remove now unneeded patch 98_fix_XSS_CVE-2011-2179
* [785a4e8] Remove unneded patch 99_fix_XSS_CVE-2011-1523
* [6ce98ef] Remove unneeded patchs from 00list
* [1d18266] Imported Upstream version 3.4.0
* [05584c8] Refresh patches
* [58098cd] Imported Upstream version 3.4.1
* [3e9e07a] Bump standards version
* [fe991e2] wrap-and-sort
* [1ba78f7] Also create /var/run/nagios in cgi package (Closes: #626854)

Show diffs side-by-side

added added

removed removed

Lines of Context:
t/618cgisecurity.t
 
1
#!/usr/bin/perl
 
2
# 
 
3
# Check that you CGI security errors are fixed
 
4
 
 
5
use warnings;
 
6
use strict;
 
7
use Test::More;
 
8
use FindBin qw($Bin);
 
9
 
 
10
chdir $Bin or die "Cannot chdir";
 
11
 
 
12
my $topdir = "$Bin/..";
 
13
my $cgi_dir = "$topdir/cgi";
 
14
 
 
15
plan 'no_plan';
 
16
 
 
17
my $output = `NAGIOS_CGI_CONFIG=etc/cgi.cfg REQUEST_METHOD=GET QUERY_STRING="layer=' style=xss:expression(alert('XSS')) '" $cgi_dir/statusmap.cgi`;
 
18
unlike( $output, qr/' style=xss:expression\(alert\('XSS'\)\) '/, "XSS injection not passed straight through" );
 
19
like( $output, qr/' style=xss:expression(alert('XSS')) '/, "Expected escaping of quotes" ) || diag $output;
 
20
 
 
21
 
 
22
$output = `REMOTE_USER=nagiosadmin NAGIOS_CGI_CONFIG=etc/cgi.cfg REQUEST_METHOD=GET QUERY_STRING="type=command&expand=<body onload=alert(666)>" $cgi_dir/config.cgi`;
 
23
unlike( $output, qr/<body onload=alert\(666\)>/, "XSS injection not passed through" ) || diag ($output);