X7ROOT File Manager
Current Path:
/home/cbholdings/pasukulu/lib/tests
home
/
cbholdings
/
pasukulu
/
lib
/
tests
/
📁
..
📄
accesslib_has_capability_test.php
(29.72 KB)
📄
accesslib_test.php
(240.86 KB)
📄
adminlib_test.php
(4.29 KB)
📄
admintree_test.php
(18.01 KB)
📄
ajaxlib_test.php
(4.4 KB)
📄
analysers_test.php
(12.79 KB)
📁
analytics
📄
antivirus_test.php
(11.81 KB)
📄
authlib_test.php
(19.04 KB)
📁
behat
📄
behat_lib_test.php
(3.25 KB)
📄
blocklib_test.php
(36.13 KB)
📄
check_test.php
(1.77 KB)
📄
client_test.php
(4.34 KB)
📄
collator_test.php
(12.06 KB)
📄
completionlib_test.php
(84.19 KB)
📄
component_test.php
(44.1 KB)
📄
componentlib_test.php
(6.91 KB)
📄
configonlylib_test.php
(5.93 KB)
📁
content
📄
content_test.php
(4.77 KB)
📁
context
📄
context_block_test.php
(4.14 KB)
📄
context_helper_test.php
(22.27 KB)
📄
context_test.php
(3.38 KB)
📄
core_media_player_native_test.php
(6.4 KB)
📄
core_renderer_template_exploit_test.php
(16.56 KB)
📄
coverage.php
(3.55 KB)
📄
cron_test.php
(6.86 KB)
📄
csslib_test.php
(1.56 KB)
📄
csvclass_test.php
(5.62 KB)
📄
curl_security_helper_test.php
(14.79 KB)
📄
customcontext_test.php
(4.66 KB)
📄
dataformat_test.php
(3.74 KB)
📄
datalib_test.php
(48.36 KB)
📄
datalib_update_with_unique_index_test.php
(6.06 KB)
📄
date_legacy_test.php
(13.62 KB)
📄
date_test.php
(25.77 KB)
📁
db
📄
editorlib_test.php
(1.95 KB)
📄
encryption_test.php
(8.68 KB)
📄
environment_test.php
(8.49 KB)
📁
event
📄
event_course_module_instance_list_viewed.php
(2.54 KB)
📄
event_course_module_viewed.php
(3.14 KB)
📄
exporter_test.php
(11.26 KB)
📁
external
📄
externallib_test.php
(2.02 KB)
📄
filelib_test.php
(77.16 KB)
📄
filestorage_zip_archive_test.php
(2.55 KB)
📄
filetypes_test.php
(10.06 KB)
📄
filter_manager_test.php
(3.31 KB)
📄
filterlib_test.php
(36.76 KB)
📁
fixtures
📄
formslib_test.php
(39.94 KB)
📄
gdlib_test.php
(5.68 KB)
📄
googlelib_test.php
(1.6 KB)
📄
gradelib_test.php
(11.96 KB)
📄
grades_external_test.php
(15.04 KB)
📄
grading_external_test.php
(26.33 KB)
📄
graphlib_test.php
(4.61 KB)
📄
grouplib_test.php
(109.11 KB)
📄
h5p_clean_orphaned_records_task_test.php
(3.16 KB)
📄
html2text_test.php
(7.54 KB)
📄
html_writer_test.php
(9.65 KB)
📄
htmlpurifier_test.php
(23.01 KB)
📄
http_client_test.php
(14.94 KB)
📁
hub
📄
ip_utils_test.php
(14.13 KB)
📄
jquery_test.php
(1.58 KB)
📄
ldaplib_test.php
(17.73 KB)
📄
licenselib_test.php
(11.58 KB)
📁
lock
📄
lock_config_test.php
(3.47 KB)
📄
lock_test.php
(5.3 KB)
📄
markdown_test.php
(2.24 KB)
📄
mathslib_test.php
(13.42 KB)
📄
medialib_test.php
(19.63 KB)
📄
message_test.php
(12.25 KB)
📄
messageinbound_test.php
(5.96 KB)
📄
messagelib_test.php
(56.36 KB)
📄
minify_test.php
(3.12 KB)
📄
modinfolib_test.php
(54.43 KB)
📄
moodle_page_test.php
(31.59 KB)
📄
moodle_url_test.php
(15.64 KB)
📄
moodlelib_current_language_test.php
(7.68 KB)
📄
moodlelib_test.php
(237.46 KB)
📁
moodlenet
📄
myprofilelib_test.php
(12.36 KB)
📁
navigation
📄
navigationlib_test.php
(31.79 KB)
📄
notification_test.php
(4.35 KB)
📁
oauth2
📄
oauth2_test.php
(23.06 KB)
📁
other
📁
output
📄
outputcomponents_test.php
(33.25 KB)
📄
outputfactories_test.php
(6.78 KB)
📄
outputrenderers_test.php
(1.62 KB)
📄
outputrequirementslib_test.php
(16.29 KB)
📄
pdflib_test.php
(3.18 KB)
📁
performance
📄
persistent_test.php
(30.53 KB)
📄
phpxmlrpc_test.php
(2.04 KB)
📄
plugin_manager_test.php
(27.4 KB)
📁
plugininfo
📄
portfoliolib_test.php
(8.4 KB)
📄
progress_display_test.php
(3.75 KB)
📄
progress_test.php
(14.48 KB)
📄
qrcode_test.php
(1.68 KB)
📄
questionlib_test.php
(100.67 KB)
📄
regex_test.php
(1.55 KB)
📄
report_helper_test.php
(2.62 KB)
📄
requirejs_test.php
(2.22 KB)
📄
rsslib_test.php
(7.35 KB)
📄
rtlcss_test.php
(56.86 KB)
📄
sample_questions.ser
(141.76 KB)
📄
sample_questions.xml
(102.62 KB)
📄
sample_questions_with_old_image_tag.ser
(4.85 KB)
📄
sample_questions_with_old_image_tag.xml
(4.08 KB)
📄
sample_questions_wrong.xml
(102.57 KB)
📄
scss_test.php
(4.26 KB)
📄
session_manager_test.php
(34.79 KB)
📄
session_redis_test.php
(13.56 KB)
📄
sessionlib_test.php
(12.32 KB)
📄
setuplib_test.php
(20.17 KB)
📄
statslib_test.php
(26.68 KB)
📄
string_manager_standard_test.php
(10.18 KB)
📄
tablelib_test.php
(25.12 KB)
📁
task
📄
text_test.php
(26.53 KB)
📄
theme_config_test.php
(9.94 KB)
📄
update_api_test.php
(6.62 KB)
📄
update_checker_test.php
(10.82 KB)
📄
update_code_manager_test.php
(8.88 KB)
📄
update_validator_test.php
(18.28 KB)
📄
upgrade_util_test.php
(5.32 KB)
📄
upgradelib_test.php
(69.6 KB)
📄
user_menu_test.php
(3.75 KB)
📄
user_test.php
(34.34 KB)
📄
useragent_test.php
(83.82 KB)
📄
weblib_format_text_test.php
(11.91 KB)
📄
weblib_test.php
(43.44 KB)
📄
xhprof_test.php
(3.14 KB)
📄
xhtml_container_stack_test.php
(4.05 KB)
📄
xmlize_test.php
(2.55 KB)
Editing: core_renderer_template_exploit_test.php
<?php // This file is part of Moodle - http://moodle.org/ // // Moodle is free software: you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by // the Free Software Foundation, either version 3 of the License, or // (at your option) any later version. // // Moodle is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // GNU General Public License for more details. // // You should have received a copy of the GNU General Public License // along with Moodle. If not, see <http://www.gnu.org/licenses/>. namespace core; /** * Unit tests for core renderer render template exploit. * * @package core * @category test * @copyright 2019 Ryan Wyllie <ryan@moodle.com> * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later */ class core_renderer_template_exploit_test extends \advanced_testcase { /** * Test cases to confirm that blacklisted helpers are stripped from the source * text by the helper before being passed to other another helper. This prevents * nested calls to helpers. */ public function get_template_testcases() { // Different helper implementations to test various combinations of nested // calls to render the templates. $norender = function($text) { return $text; }; $singlerender = function($text, $helper) { return $helper->render($text); }; $recursiverender = function($text, $helper) { $result = $helper->render($text); while (strpos($result, '{{') != false) { $result = $helper->render($result); } return $result; }; return [ 'nested JS helper' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{#js}} some nasty JS {{/js}}{{/testpix}}', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $singlerender ], 'js' => 'some nasty JS', 'expected' => 'core, move,', 'include' => false ], 'other nested helper' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{#test1}} some text {{/test1}}{{/testpix}}', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $singlerender, 'test1' => $norender, ], 'js' => 'some nasty JS', 'expected' => 'core, move, some text', 'include' => false ], 'double nested helper' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{#test1}} some text {{#js}} some nasty JS {{/js}} {{/test1}}{{/testpix}}', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $singlerender, 'test1' => $norender, ], 'js' => 'some nasty JS', 'expected' => 'core, move, some text {{}}', 'include' => false ], 'js helper not nested' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, some text {{/testpix}}{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $singlerender ], 'js' => 'some nasty JS', 'expected' => 'core, move, some text', 'include' => true ], 'js in context not in helper' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{/testpix}}{{hack}}', ], 'torender' => 'test', 'context' => [ 'hack' => '{{#js}} some nasty JS {{/js}}' ], 'helpers' => [ 'testpix' => $singlerender ], 'js' => 'some nasty JS', 'expected' => 'core, move, {{#js}} some nasty JS {{/js}}', 'include' => false ], 'js in context' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{hack}}{{/testpix}}', ], 'torender' => 'test', 'context' => [ 'hack' => '{{#js}} some nasty JS {{/js}}' ], 'helpers' => [ 'testpix' => $singlerender ], 'js' => 'some nasty JS', 'expected' => 'core, move, {{}}', 'include' => false ], 'js in context double depth with single render' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{first}}{{/testpix}}', ], 'torender' => 'test', 'context' => [ 'first' => '{{second}}', 'second' => '{{#js}} some nasty JS {{/js}}' ], 'helpers' => [ 'testpix' => $singlerender ], 'js' => 'some nasty JS', 'expected' => 'core, move, {{second}}', 'include' => false ], 'js in context double depth with recursive render' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{first}}{{/testpix}}', ], 'torender' => 'test', 'context' => [ 'first' => '{{second}}', 'second' => '{{#js}} some nasty JS {{/js}}' ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move,', 'include' => false ], 'partial' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, blah{{/testpix}}, {{> test2}}', 'test2' => 'some content', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, blah, some content', 'include' => false ], 'partial nested' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{> test2}}{{/testpix}}', 'test2' => 'some content', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, some content', 'include' => false ], 'partial with js' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, blah{{/testpix}}, {{> test2}}', 'test2' => '{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, blah,', 'include' => true ], 'partial nested with js' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{> test2}}{{/testpix}}', 'test2' => '{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move,', 'include' => false ], 'partial with js from context' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, blah{{/testpix}}, {{{foo}}}', 'test2' => '{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [ 'foo' => '{{> test2}}' ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, blah, {{> test2}}', 'include' => false ], 'partial nested with js from context recursive render' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}', 'test2' => '{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [ 'foo' => '{{> test2}}' ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move,', 'include' => false ], 'partial nested with js from context single render' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}', 'test2' => '{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [ 'foo' => '{{> test2}}' ], 'helpers' => [ 'testpix' => $singlerender ], 'js' => 'some nasty JS', 'expected' => 'core, move, {{> test2}}', 'include' => false ], 'partial double nested with js from context recursive render' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}', 'test2' => '{{#js}} some nasty JS {{/js}}', ], 'torender' => 'test', 'context' => [ 'foo' => '{{bar}}', 'bar' => '{{> test2}}' ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move,', 'include' => false ], 'array context depth 1' => [ 'templates' => [ 'test' => '{{#items}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/items}}' ], 'torender' => 'test', 'context' => [ 'items' => [ 'legit', '{{#js}}some nasty JS{{/js}}' ] ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, legit core, move,', 'include' => false ], 'array context depth 2' => [ 'templates' => [ 'test' => '{{#items}}{{#subitems}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/subitems}}{{/items}}' ], 'torender' => 'test', 'context' => [ 'items' => [ [ 'subitems' => [ 'legit', '{{#js}}some nasty JS{{/js}}' ] ], ] ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, legit core, move,', 'include' => false ], 'object context depth 1' => [ 'templates' => [ 'test' => '{{#items}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/items}}' ], 'torender' => 'test', 'context' => (object) [ 'items' => [ 'legit', '{{#js}}some nasty JS{{/js}}' ] ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, legit core, move,', 'include' => false ], 'object context depth 2' => [ 'templates' => [ 'test' => '{{#items}}{{#subitems}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/subitems}}{{/items}}' ], 'torender' => 'test', 'context' => (object) [ 'items' => [ (object) [ 'subitems' => [ 'legit', '{{#js}}some nasty JS{{/js}}' ] ], ] ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move, legit core, move,', 'include' => false ], 'change delimeters' => [ 'templates' => [ 'test' => '{{#testpix}} core, move, {{{foo}}}{{/testpix}}' ], 'torender' => 'test', 'context' => [ 'foo' => '{{=<% %>=}} <%#js%>some nasty JS,<%/js%>' ], 'helpers' => [ 'testpix' => $recursiverender ], 'js' => 'some nasty JS', 'expected' => 'core, move,', 'include' => false ] ]; } /** * Test that the mustache_helper_collection class correctly strips * @dataProvider get_template_testcases() * @param array $templates The template to add * @param string $torender The name of the template to render * @param array $context The template context * @param array $helpers Mustache helpers to add * @param string $js The JS string from the template * @param string $expected The expected output of the string after stripping JS * @param bool $include If the JS should be added to the page or not */ public function test_core_mustache_engine_strips_js_helper( $templates, $torender, $context, $helpers, $js, $expected, $include ) { $page = new \moodle_page(); $renderer = $page->get_renderer('core'); // Get the mustache engine from the renderer. $reflection = new \ReflectionMethod($renderer, 'get_mustache'); $reflection->setAccessible(true); $engine = $reflection->invoke($renderer); // Swap the loader out with an array loader so that we can set some // inline templates for testing. $loader = new \Mustache_Loader_ArrayLoader([]); $engine->setLoader($loader); // Add our test helpers. $helpercollection = $engine->getHelpers(); foreach ($helpers as $name => $function) { $helpercollection->add($name, $function); } // Add our test template to be rendered. foreach ($templates as $name => $template) { $loader->setTemplate($name, $template); } // Confirm that the rendered template matches what we expect. $this->assertEquals($expected, trim($engine->render($torender, $context))); if ($include) { // Confirm that the JS was added to the page. $this->assertStringContainsString($js, $page->requires->get_end_code()); } else { // Confirm that the JS wasn't added to the page. $this->assertStringNotContainsString($js, $page->requires->get_end_code()); } } }
Upload File
Create Folder