|
| 1 | +--TEST-- |
| 2 | +Bug #61367: open_basedir bypass in libxml RSHUTDOWN: read test |
| 3 | +--SKIPIF-- |
| 4 | +<?php |
| 5 | +if(!extension_loaded('dom')) echo 'skip dom extension not available'; |
| 6 | +if (LIBXML_VERSION < 20912) die('skip For libxml2 >= 2.9.12 only'); |
| 7 | +?> |
| 8 | +--INI-- |
| 9 | +open_basedir=. |
| 10 | +--FILE-- |
| 11 | +<?php |
| 12 | +/* |
| 13 | + * Note: Using error_reporting=E_ALL & ~E_NOTICE to suppress "Trying to get property of non-object" notices. |
| 14 | + */ |
| 15 | +class StreamExploiter { |
| 16 | + public function stream_close ( ) { |
| 17 | + $doc = new DOMDocument; |
| 18 | + $doc->resolveExternals = true; |
| 19 | + $doc->substituteEntities = true; |
| 20 | + $dir = htmlspecialchars(dirname(getcwd())); |
| 21 | + $dir = str_replace('\\', '/', $dir); // fix for windows |
| 22 | + $doc->loadXML( <<<XML |
| 23 | +<!DOCTYPE doc [ |
| 24 | + <!ENTITY file SYSTEM "file:///$dir/bad"> |
| 25 | +]> |
| 26 | +<doc>&file;</doc> |
| 27 | +XML |
| 28 | + ); |
| 29 | + print $doc->documentElement->firstChild->nodeValue; |
| 30 | + } |
| 31 | + |
| 32 | + public function stream_open ( $path , $mode , $options , &$opened_path ) { |
| 33 | + return true; |
| 34 | + } |
| 35 | +} |
| 36 | + |
| 37 | +var_dump(mkdir('test_bug_61367-read')); |
| 38 | +var_dump(mkdir('test_bug_61367-read/base')); |
| 39 | +var_dump(file_put_contents('test_bug_61367-read/bad', 'blah')); |
| 40 | +var_dump(chdir('test_bug_61367-read/base')); |
| 41 | + |
| 42 | +stream_wrapper_register( 'exploit', 'StreamExploiter' ); |
| 43 | +$s = fopen( 'exploit://', 'r' ); |
| 44 | + |
| 45 | +?> |
| 46 | +--CLEAN-- |
| 47 | +<?php |
| 48 | +unlink('test_bug_61367-read/bad'); |
| 49 | +rmdir('test_bug_61367-read/base'); |
| 50 | +rmdir('test_bug_61367-read'); |
| 51 | +?> |
| 52 | +--EXPECTF-- |
| 53 | +bool(true) |
| 54 | +bool(true) |
| 55 | +int(4) |
| 56 | +bool(true) |
| 57 | + |
| 58 | +Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "file:///%s/test_bug_61367-read/bad" in %s on line %d |
| 59 | + |
| 60 | +Warning: Attempt to read property "nodeValue" on null in %s on line %d |
0 commit comments