Permalink
Browse files

Fixed a security bug.

  • Loading branch information...
1 parent bc96258 commit 029d979316fbcb79faa7597e5981455350099af7 @dahlia dahlia committed Nov 27, 2009
Showing with 25 additions and 4 deletions.
  1. +1 −1 Lisphp/List.php
  2. +3 −1 Lisphp/Runtime/Function.php
  3. +6 −0 Lisphp/Test/ListTest.php
  4. +15 −2 Lisphp/Test/RuntimeTest.php
View
2 Lisphp/List.php
@@ -7,7 +7,7 @@ class Lisphp_List extends ArrayObject implements Lisphp_Form {
function evaluate(Lisphp_Scope $scope) {
$function = $this->car()->evaluate($scope);
$applicable = $function instanceof Lisphp_Applicable;
- if (is_callable($function)) {
+ if (is_callable($function) && is_object($function)) {
$parameters = array();
foreach ($this->cdr() as $arg) {
$parameters[] = $arg->evaluate($scope);
View
4 Lisphp/Runtime/Function.php
@@ -9,7 +9,9 @@ class Lisphp_Runtime_Function implements Lisphp_Applicable {
static function call($func, array $args) {
if ($func instanceof self) return $func->execute($args);
- else if (is_callable($func)) return call_user_func_array($func, $args);
+ else if (is_callable($func) && is_object($func)) {
+ return call_user_func_array($func, $args);
+ }
throw new InvalidArgumentException('expected callable value');
}
View
6 Lisphp/Test/ListTest.php
@@ -20,6 +20,12 @@ function testInvalidApplication() {
$this->list->evaluate(new Lisphp_Scope);
}
+ function testInvalidApplication2() {
+ $this->setExpectedException('InvalidApplicationException');
+ $l = Lisphp_Parser::parseForm('("trim" " hello ")', $_);
+ $l->evaluate(new Lisphp_Scope);
+ }
+
function testEvaluate() {
$scope = new Lisphp_Scope;
$scope['define'] = new Lisphp_Runtime_Define;
View
17 Lisphp/Test/RuntimeTest.php
@@ -204,8 +204,12 @@ function testGenericCall() {
array(1, 2)
);
$this->assertEquals(3, $val);
- $val = Lisphp_Runtime_Function::call('trim', array(' hello '));
- $this->assertEquals('hello', $val);
+ try {
+ Lisphp_Runtime_Function::call('trim', array('a'));
+ $this->fail();
+ } catch (InvalidArgumentException $e) {
+ # pass
+ }
try {
Lisphp_Runtime_Function::call(1, array());
$this->fail();
@@ -214,6 +218,15 @@ function testGenericCall() {
}
}
+ function testGenericCall530() {
+ if (version_compare(phpversion(), '5.3.0', '<')) {
+ $this->markTestSkipped('PHP version is less than 5.3.0.');
+ }
+ eval('$f = function($a, $b) { return $a + $b; };');
+ $val = Lisphp_Runtime_Function::call($f, array(1, 2));
+ $this->assertEquals(3, $val);
+ }
+
function testApply() {
$apply = new Lisphp_Runtime_Apply;
$add = new Lisphp_Runtime_Arithmetic_Addition;

0 comments on commit 029d979

Please sign in to comment.