[BUGFIX] Prevent infinite loop in BooleanParser (#821)

This change prevents an infinite loop if single or double quotes in boolean expressions are not properly closed. Resolves: #667
TYPO3 · Oct 30, 2023 · 7d0b084 · 7d0b084
1 parent aa17b62
commit 7d0b084
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 0 deletions.
diff --git a/src/Core/Parser/BooleanParser.php b/src/Core/Parser/BooleanParser.php
@@ -288,6 +288,10 @@ protected function parseStringToken()
             while (trim($t = $this->peek(true)) !== $stringIdentifier) {
                 $this->consume($t);
                 $string .= $t;
+
+                if ($t === '') {
+                    throw new Exception(sprintf('Closing string token expected in boolean expression "%s".', $this->expression), 1697479462);
+                }
             }
             $this->consume($stringIdentifier);
             $string .= $stringIdentifier;

diff --git a/tests/Unit/Core/Parser/BooleanParserTest.php b/tests/Unit/Core/Parser/BooleanParserTest.php
@@ -10,6 +10,7 @@
 namespace TYPO3Fluid\Fluid\Tests\Unit\Core\Parser;
 
 use TYPO3Fluid\Fluid\Core\Parser\BooleanParser;
+use TYPO3Fluid\Fluid\Core\Parser\Exception;
 use TYPO3Fluid\Fluid\Core\Parser\SyntaxTree\BooleanNode;
 use TYPO3Fluid\Fluid\Core\Rendering\RenderingContext;
 use TYPO3Fluid\Fluid\Tests\UnitTestCase;
@@ -120,4 +121,31 @@ public function testSomeEvaluations(string $comparison, bool $expected, array $v
         eval('function ' . $functionName . '($context) {return ' . $compiledEvaluation . ';}');
         self::assertEquals($expected, BooleanNode::convertToBoolean($functionName($variables), $renderingContext), 'compiled Expression: ' . $compiledEvaluation);
     }
+
+    public static function invalidEvaluationsDataProvider(): array
+    {
+        return [
+            ['{pageClass} == "myClass', ['pageClass' => 'myClass']],
+            ['{pageClass} == \'myClass', ['pageClass' => 'myClass']],
+            ['\'string1\' == \'string2', []],
+        ];
+    }
+
+    /**
+     * @test
+     * @dataProvider invalidEvaluationsDataProvider
+     */
+    public function invalidEvaluations(string $comparison, array $variables = []): void
+    {
+        $this->expectException(Exception::class);
+        $this->expectExceptionCode(1697479462);
+
+        $renderingContext = new RenderingContext();
+        $parser = new BooleanParser();
+        BooleanNode::convertToBoolean($parser->evaluate($comparison, $variables), $renderingContext);
+        $compiledEvaluation = $parser->compile($comparison);
+        $functionName = 'expression_' . md5($comparison . rand(0, 100000));
+        eval('function ' . $functionName . '($context) {return ' . $compiledEvaluation . ';}');
+        BooleanNode::convertToBoolean($functionName($variables), $renderingContext);
+    }
 }