1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
# please insert nothing before this line: -*- mode: cperl; cperl-indent-level: 4; cperl-continued-statement-offset: 4; indent-tabs-mode: nil -*-
package TestCommon::Utils;
use strict;
use warnings FATAL => 'all';
use APR::Brigade ();
use APR::Bucket ();
use Apache2::Filter ();
use Apache2::Connection ();
use Apache2::Const -compile => qw(MODE_READBYTES);
use APR::Const -compile => qw(SUCCESS BLOCK_READ);
use constant IOBUFSIZE => 8192;
# perl 5.6.x only triggers taint protection on strings which are at
# least one char long
sub is_tainted {
return ! eval {
eval join '', '#',
map defined() ? substr($_, 0, 0) : (), @_;
1;
};
}
# to enable debug start with: (or simply run with -trace=debug)
# t/TEST -trace=debug -start
sub read_post {
my $r = shift;
my $debug = shift || 0;
my $bb = APR::Brigade->new($r->pool,
$r->connection->bucket_alloc);
my $data = '';
my $seen_eos = 0;
my $count = 0;
do {
$r->input_filters->get_brigade($bb, Apache2::Const::MODE_READBYTES,
APR::Const::BLOCK_READ, IOBUFSIZE);
$count++;
warn "read_post: bb $count\n" if $debug;
while (!$bb->is_empty) {
my $b = $bb->first;
if ($b->is_eos) {
warn "read_post: EOS bucket:\n" if $debug;
$seen_eos++;
last;
}
if ($b->read(my $buf)) {
warn "read_post: DATA bucket: [$buf]\n" if $debug;
$data .= $buf;
}
$b->delete;
}
} while (!$seen_eos);
$bb->destroy;
return $data;
}
1;
__END__
=head1 NAME
TestCommon::Utils - Common Test Utils
=head1 Synopsis
use TestCommon::Utils;
# test whether some SV is tainted
$b->read(my $data);
ok TestCommon::Utils::is_tainted($data);
my $data = TestCommon::Utils::read_post($r);
=head1 Description
Various handy testing utils
=head1 API
=head2 is_tainted
is_tainted(@data);
returns I<TRUE> if at least one element in C<@data> is tainted,
I<FALSE> otherwise.
=head2 read_post
my $data = TestCommon::Utils::read_post($r);
my $data = TestCommon::Utils::read_post($r, $debug);
reads the posted data using bucket brigades manipulation.
To enable debug pass a true argument C<$debug>
=cut
|
