Skip to content
Permalink
Browse files

fixed possible vulnerability loading help files

  • Loading branch information...
Doug Bell
Doug Bell committed Aug 11, 2010
1 parent 39e3c4f commit 6b1e02f764a7762c5505f7eb0c780acab8fd786e
Showing with 17 additions and 9 deletions.
  1. +1 −0 docs/changelog/7.x.x.txt
  2. +5 −7 lib/WebGUI/Operation/Help.pm
  3. +11 −2 t/Help/compiled.t
@@ -2,6 +2,7 @@
- webgui.org homepage gives 404 (#11778)
- fixed #11779: SQLReport can run arbitrary queries
- fixed possible vulnerability loading template parser
- fixed possible vulnerability loading help files

7.9.11
- fixed #11755: New cart does not update shipping methods correctly
@@ -41,18 +41,16 @@ been already and logs errors during the load.
sub _loadHelp {
my $session = shift;
my $helpPackage = shift;
eval { WebGUI::Pluggable::load( $helpPackage ); };
if ($@) {
$session->errorHandler->error("Help failed to compile: $helpPackage. ".$@);
return {};
}
if (defined *{"$helpPackage\::HELP"}) { ##Symbol table lookup
our $table;
*table = *{"$helpPackage\::HELP"}; ##Create alias into symbol table
return $table; ##return whole hashref
}
my $load = sprintf 'use %-s; $%-s::HELP', $helpPackage, $helpPackage;
my $help = eval($load);
if ($@) {
$session->errorHandler->error("Help failed to compile: $helpPackage. ".$@);
return {};
}
return $help;
}

#-------------------------------------------------------------------
@@ -15,13 +15,14 @@ use lib "$FindBin::Bin/../lib";
use WebGUI::Test;
use WebGUI::Session;
use WebGUI::Operation::Help;
use Test::More;
use Test::Exception;

#The goal of this test is to verify that all entries in the lib/WebGUI/Help
#directory compile. This test is necessary because WebGUI::Operation::Help
#will return an empty hash if it won't compile, and the help will simply
#disappear.

use Test::More;
my $numTests = 0;

my $session = WebGUI::Test->session;
@@ -30,10 +31,18 @@ my @helpFileSet = WebGUI::Operation::Help::_getHelpFilesList($session);

$numTests = scalar @helpFileSet; #One for each help compile

plan tests => $numTests;
plan tests => $numTests + 2;

foreach my $helpSet (@helpFileSet) {
my $helpName = $helpSet->[1];
my $help = WebGUI::Operation::Help::_load($session, $helpName);
ok(keys %{ $help }, "$helpName compiled");
}

#----------------------------------------------------------------------------
# Test invalid help files
WebGUI::Test->interceptLogging;
lives_ok { WebGUI::Operation::Help::_load( $session, '::HI::' ) } "invalid help module doesnt die";
like( $WebGUI::Test::logger_error, qr/^Help failed to compile/, 'invalid help module errored' );

WebGUI::Test->restoreLogging;

0 comments on commit 6b1e02f

Please sign in to comment.
You can’t perform that action at this time.