fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-05-10 20:44:28 +09:00
Code Issues Projects Releases Packages Wiki Activity

Rename checkXEE() to checkXXE()

Browse source
This commit is contained in:
Kijin Sung 2018-10-18 14:21:08 +09:00
parent 6a7b1e3fd2
commit af64ae79c1
4 changed files with 15 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
classes/context/Context.class.php
View file

@ -1206,7 +1206,7 @@ class Context
{ {
if(self::getRequestMethod() === 'XMLRPC') if(self::getRequestMethod() === 'XMLRPC')
{ {
if(!Rhymix\Framework\Security::checkXEE($GLOBALS['HTTP_RAW_POST_DATA'])) if(!Rhymix\Framework\Security::checkXXE($GLOBALS['HTTP_RAW_POST_DATA']))
{ {
header("HTTP/1.0 400 Bad Request"); header("HTTP/1.0 400 Bad Request");
exit; exit;

2
classes/security/Security.class.php
View file

@ -185,7 +185,7 @@ class Security
*/ */
public static function detectingXEE($xml) public static function detectingXEE($xml)
{ {
return !Rhymix\Framework\Security::checkXEE($xml); return !Rhymix\Framework\Security::checkXXE($xml);
} }
} }
/* End of file : Security.class.php */ /* End of file : Security.class.php */

9
common/framework/security.php
View file

@ -350,16 +350,17 @@ class Security
} }
/** /**
* Check if the current request seems to be an XEE attack. * Check if the current request seems to be an XXE (XML external entity) attack.
* *
* This method returns true if the request seems to be innocent, * This method returns true if the request seems to be innocent,
* and false if it seems to be an XEE attack. * and false if it seems to be an XXE attack.
* This is the opposite of XE's Security::detectXEE() method. * This is the opposite of XE's Security::detectingXEE() method.
* The name has also been changed to the more accurate acronym XXE.
* *
* @param string $xml (optional) * @param string $xml (optional)
* @return bool * @return bool
*/ */
public static function checkXEE($xml = null) public static function checkXXE($xml = null)
{ {
// Stop if there is no XML content. // Stop if there is no XML content.
if (!$xml) if (!$xml)

16
tests/unit/framework/SecurityTest.php
View file

@ -145,27 +145,27 @@ class SecurityTest extends \Codeception\TestCase\Test
error_reporting($error_reporting); error_reporting($error_reporting);
} }
public function testCheckXEE() public function testCheckXXE()
{ {
$xml = '<methodCall></methodCall>'; $xml = '<methodCall></methodCall>';
$this->assertTrue(Rhymix\Framework\Security::checkXEE($xml)); $this->assertTrue(Rhymix\Framework\Security::checkXXE($xml));
$xml = '<?xml version="1.0" encoding="UTF-8"?><methodCall></methodCall>'; $xml = '<?xml version="1.0" encoding="UTF-8"?><methodCall></methodCall>';
$this->assertTrue(Rhymix\Framework\Security::checkXEE($xml)); $this->assertTrue(Rhymix\Framework\Security::checkXXE($xml));
$xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo><methodCall attr="value"></methodCall>'; $xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo><methodCall attr="value"></methodCall>';
$this->assertTrue(Rhymix\Framework\Security::checkXEE($xml)); $this->assertTrue(Rhymix\Framework\Security::checkXXE($xml));
$xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo><whatever></whatever>'; $xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo><whatever></whatever>';
$this->assertFalse(Rhymix\Framework\Security::checkXEE($xml)); $this->assertFalse(Rhymix\Framework\Security::checkXXE($xml));
$xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo>'; $xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo>';
$this->assertFalse(Rhymix\Framework\Security::checkXEE($xml)); $this->assertFalse(Rhymix\Framework\Security::checkXXE($xml));
$xml = '<?xml version="1.0" encoding="UTF-8"?><!ENTITY xxe SYSTEM "http://www.attacker.com/text.txt"><methodCall></methodCall>'; $xml = '<?xml version="1.0" encoding="UTF-8"?><!ENTITY xxe SYSTEM "http://www.attacker.com/text.txt"><methodCall></methodCall>';
$this->assertFalse(Rhymix\Framework\Security::checkXEE($xml)); $this->assertFalse(Rhymix\Framework\Security::checkXXE($xml));
$xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><fault></fault>'; $xml = '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><fault></fault>';
$this->assertFalse(Rhymix\Framework\Security::checkXEE($xml)); $this->assertFalse(Rhymix\Framework\Security::checkXXE($xml));
} }
} }