4 my %Expect_File = (); # what we expect for $_
5 my %Expect_Name = (); # what we expect for $File::Find::name/fullname
6 my %Expect_Dir = (); # what we expect for $File::Find::dir
7 my ($cwd, $cwd_untainted);
12 unshift @INC => '../lib';
19 for (keys %ENV) { # untaint ENV
20 ($ENV{$_}) = $ENV{$_} =~ /(.*)/;
24 # Remove insecure directories from PATH
26 my $sep = $Config{path_sep};
27 foreach my $dir (split(/\Q$sep/,$ENV{'PATH'}))
30 ## Match the directory taint tests in mg.c::Perl_magic_setenv()
32 push(@path,$dir) unless (length($dir) >= 256
34 substr($dir,0,1) ne "/"
36 (stat $dir)[2] & 002);
38 $ENV{'PATH'} = join($sep,@path);
41 use Test::More tests => 45;
43 my $symlink_exists = eval { symlink("",""); 1 };
52 find({wanted => sub { $found = 1 if ($_ eq '1_compile.t') },
53 untaint => 1, untaint_pattern => qr|^(.+)$|}, File::Spec->curdir);
55 ok($found, '1_compile.t found');
58 finddepth({wanted => sub { $found = 1 if $_ eq '1_compile.t'; },
59 untaint => 1, untaint_pattern => qr|^(.+)$|}, File::Spec->curdir);
61 ok($found, '1_compile.t found again');
64 my $FastFileTests_OK = 0;
67 if (-d dir_path('for_find')) {
68 chdir(dir_path('for_find'));
70 if (-d dir_path('fa')) {
71 unlink file_path('fa', 'fa_ord'),
72 file_path('fa', 'fsl'),
73 file_path('fa', 'faa', 'faa_ord'),
74 file_path('fa', 'fab', 'fab_ord'),
75 file_path('fa', 'fab', 'faba', 'faba_ord'),
76 file_path('fb', 'fb_ord'),
77 file_path('fb', 'fba', 'fba_ord');
78 rmdir dir_path('fa', 'faa');
79 rmdir dir_path('fa', 'fab', 'faba');
80 rmdir dir_path('fa', 'fab');
82 rmdir dir_path('fb', 'fba');
85 chdir File::Spec->updir;
86 if (-d dir_path('for_find')) {
87 rmdir dir_path('for_find') or print "# Can't rmdir for_find: $!\n";
96 ok( open(my $T,'>',$_[0]), "Opened $_[0] successfully" );
100 ok( mkdir($_[0],$_[1]), "Created directory $_[0] successfully" );
103 sub wanted_File_Dir {
104 print "# \$File::Find::dir => '$File::Find::dir'\n";
105 print "# \$_ => '$_'\n";
106 s#\.$## if ($^O eq 'VMS' && $_ ne '.');
107 ok( $Expect_File{$_}, "Expected and found $File::Find::name" );
108 if ( $FastFileTests_OK ) {
109 delete $Expect_File{ $_}
110 unless ( $Expect_Dir{$_} && ! -d _ );
112 delete $Expect_File{$_}
113 unless ( $Expect_Dir{$_} && ! -d $_ );
117 sub wanted_File_Dir_prune {
119 $File::Find::prune=1 if $_ eq 'faba';
123 print "# \$File::Find::dir => '$File::Find::dir'\n";
124 print "# \$_ => '$_'\n";
128 # Use dir_path() to specify a directory path that's expected for
129 # $File::Find::dir (%Expect_Dir). Also use it in file operations like
132 # dir_path() concatenates directory names to form a *relative*
133 # directory path, independent from the platform it's run on, although
134 # there are limitations. Don't try to create an absolute path,
135 # because that may fail on operating systems that have the concept of
136 # volume names (e.g. Mac OS). As a special case, you can pass it a "."
137 # as first argument, to create a directory path like "./fa/dir" on
138 # operating systems other than Mac OS (actually, Mac OS will ignore
139 # the ".", if it's the first argument). If there's no second argument,
140 # this function will return the empty string on Mac OS and the string
144 my $first_arg = shift @_;
146 if ($first_arg eq '.') {
147 if ($^O eq 'MacOS') {
149 # ignore first argument; return a relative path
150 # with leading ":" and with trailing ":"
151 return File::Spec->catdir(@_);
153 return './' unless @_;
154 my $path = File::Spec->catdir(@_);
160 } else { # $first_arg ne '.'
161 return $first_arg unless @_; # return plain filename
162 return File::Spec->catdir($first_arg, @_); # relative path
167 # Use topdir() to specify a directory path that you want to pass to
168 # find/finddepth. Basically, topdir() does the same as dir_path() (see
169 # above), except that there's no trailing ":" on Mac OS.
172 my $path = dir_path(@_);
173 $path =~ s/:$// if ($^O eq 'MacOS');
178 # Use file_path() to specify a file path that's expected for $_
179 # (%Expect_File). Also suitable for file operations like unlink etc.
181 # file_path() concatenates directory names (if any) and a filename to
182 # form a *relative* file path (the last argument is assumed to be a
183 # file). It's independent from the platform it's run on, although
184 # there are limitations. As a special case, you can pass it a "." as
185 # first argument, to create a file path like "./fa/file" on operating
186 # systems other than Mac OS (actually, Mac OS will ignore the ".", if
187 # it's the first argument). If there's no second argument, this
188 # function will return the empty string on Mac OS and the string "./"
192 my $first_arg = shift @_;
194 if ($first_arg eq '.') {
195 if ($^O eq 'MacOS') {
197 # ignore first argument; return a relative path
198 # with leading ":", but without trailing ":"
199 return File::Spec->catfile(@_);
201 return './' unless @_;
202 my $path = File::Spec->catfile(@_);
208 } else { # $first_arg ne '.'
209 return $first_arg unless @_; # return plain filename
210 return File::Spec->catfile($first_arg, @_); # relative path
215 # Use file_path_name() to specify a file path that's expected for
216 # $File::Find::Name (%Expect_Name). Note: When the no_chdir => 1
217 # option is in effect, $_ is the same as $File::Find::Name. In that
218 # case, also use this function to specify a file path that's expected
221 # Basically, file_path_name() does the same as file_path() (see
222 # above), except that there's always a leading ":" on Mac OS, even for
223 # plain file/directory names.
226 my $path = file_path(@_);
227 $path = ":$path" if (($^O eq 'MacOS') && ($path !~ /:/));
232 MkDir( dir_path('for_find'), 0770 );
233 ok( chdir( dir_path('for_find')), 'successful chdir() to for_find' );
235 $cwd = cwd(); # save cwd
236 ( $cwd_untainted ) = $cwd =~ m|^(.+)$|; # untaint it
238 MkDir( dir_path('fa'), 0770 );
239 MkDir( dir_path('fb'), 0770 );
240 touch( file_path('fb', 'fb_ord') );
241 MkDir( dir_path('fb', 'fba'), 0770 );
242 touch( file_path('fb', 'fba', 'fba_ord') );
244 skip "Creating symlink", 1, unless $symlink_exists;
245 if ($^O eq 'MacOS') {
246 ok( symlink(':fb',':fa:fsl'), 'Created symbolic link' );
248 ok( symlink('../fb','fa/fsl'), 'Created symbolic link' );
251 touch( file_path('fa', 'fa_ord') );
253 MkDir( dir_path('fa', 'faa'), 0770 );
254 touch( file_path('fa', 'faa', 'faa_ord') );
255 MkDir( dir_path('fa', 'fab'), 0770 );
256 touch( file_path('fa', 'fab', 'fab_ord') );
257 MkDir( dir_path('fa', 'fab', 'faba'), 0770 );
258 touch( file_path('fa', 'fab', 'faba', 'faba_ord') );
260 print "# check untainting (no follow)\n";
262 # untainting here should work correctly
264 %Expect_File = (File::Spec->curdir => 1, file_path('fsl') =>
265 1,file_path('fa_ord') => 1, file_path('fab') => 1,
266 file_path('fab_ord') => 1, file_path('faba') => 1,
267 file_path('faa') => 1, file_path('faa_ord') => 1);
268 delete $Expect_File{ file_path('fsl') } unless $symlink_exists;
271 %Expect_Dir = ( dir_path('fa') => 1, dir_path('faa') => 1,
272 dir_path('fab') => 1, dir_path('faba') => 1,
273 dir_path('fb') => 1, dir_path('fba') => 1);
275 delete @Expect_Dir{ dir_path('fb'), dir_path('fba') } unless $symlink_exists;
277 File::Find::find( {wanted => \&wanted_File_Dir_prune, untaint => 1,
278 untaint_pattern => qr|^(.+)$|}, topdir('fa') );
280 is(scalar keys %Expect_File, 0, 'Found all expected files');
283 # don't untaint at all, should die
288 eval {File::Find::find( {wanted => \&simple_wanted}, topdir('fa') );};
289 like( $@, qr|Insecure dependency|, 'Tainted directory causes death (good)' );
290 chdir($cwd_untainted);
293 # untaint pattern doesn't match, should die
296 eval {File::Find::find( {wanted => \&simple_wanted, untaint => 1,
297 untaint_pattern => qr|^(NO_MATCH)$|},
300 like( $@, qr|is still tainted|, 'Bad untaint pattern causes death (good)' );
301 chdir($cwd_untainted);
304 # untaint pattern doesn't match, should die when we chdir to cwd
305 print "# check untaint_skip (No follow)\n";
308 eval {File::Find::find( {wanted => \&simple_wanted, untaint => 1,
309 untaint_skip => 1, untaint_pattern =>
310 qr|^(NO_MATCH)$|}, topdir('fa') );};
314 like( $@, qr|insecure cwd|, 'Bad untaint pattern causes death in cwd (good)' );
316 chdir($cwd_untainted);
320 skip "Symbolic link tests", 17, unless $symlink_exists;
321 print "# --- symbolic link tests --- \n";
322 $FastFileTests_OK= 1;
324 print "# check untainting (follow)\n";
326 # untainting here should work correctly
327 # no_chdir is in effect, hence we use file_path_name to specify the expected paths for %Expect_File
329 %Expect_File = (file_path_name('fa') => 1,
330 file_path_name('fa','fa_ord') => 1,
331 file_path_name('fa', 'fsl') => 1,
332 file_path_name('fa', 'fsl', 'fb_ord') => 1,
333 file_path_name('fa', 'fsl', 'fba') => 1,
334 file_path_name('fa', 'fsl', 'fba', 'fba_ord') => 1,
335 file_path_name('fa', 'fab') => 1,
336 file_path_name('fa', 'fab', 'fab_ord') => 1,
337 file_path_name('fa', 'fab', 'faba') => 1,
338 file_path_name('fa', 'fab', 'faba', 'faba_ord') => 1,
339 file_path_name('fa', 'faa') => 1,
340 file_path_name('fa', 'faa', 'faa_ord') => 1);
344 %Expect_Dir = (dir_path('fa') => 1,
345 dir_path('fa', 'faa') => 1,
346 dir_path('fa', 'fab') => 1,
347 dir_path('fa', 'fab', 'faba') => 1,
349 dir_path('fb', 'fba') => 1);
351 File::Find::find( {wanted => \&wanted_File_Dir, follow_fast => 1,
352 no_chdir => 1, untaint => 1, untaint_pattern =>
353 qr|^(.+)$| }, topdir('fa') );
355 is( scalar(keys %Expect_File), 0, 'Found all files in symlink test' );
358 # don't untaint at all, should die
361 eval {File::Find::find( {wanted => \&simple_wanted, follow => 1},
364 like( $@, qr|Insecure dependency|, 'Not untainting causes death (good)' );
365 chdir($cwd_untainted);
367 # untaint pattern doesn't match, should die
370 eval {File::Find::find( {wanted => \&simple_wanted, follow => 1,
371 untaint => 1, untaint_pattern =>
372 qr|^(NO_MATCH)$|}, topdir('fa') );};
374 like( $@, qr|is still tainted|, 'Bat untaint pattern causes death (good)' );
375 chdir($cwd_untainted);
377 # untaint pattern doesn't match, should die when we chdir to cwd
378 print "# check untaint_skip (Follow)\n";
381 eval {File::Find::find( {wanted => \&simple_wanted, untaint => 1,
382 untaint_skip => 1, untaint_pattern =>
383 qr|^(NO_MATCH)$|}, topdir('fa') );};
384 like( $@, qr|insecure cwd|, 'Cwd not untainted with bad pattern (good)' );
386 chdir($cwd_untainted);