Changeset 33598

Timestamp:

11/25/12 10:57:29 (7 months ago)

Author:

fabien

Message:

[1.4] fixed the possibility to fake a file upload

Files:

• branches/1.4/lib/form/sfForm.class.php (modified) (2 diffs)
• branches/1.4/test/unit/form/sfFormTest.php (modified) (2 diffs)

branches/1.4/lib/form/sfForm.class.php

@@ -223 +223 @@
-    }
-
+    $this->checkTaintedValues($this->taintedValues);
+
-    try
-    {
@@ -1337 +1339 @@
-    return $array1;
-  }
+
+  /**
+   * Checks that the $_POST values do not contain something that
+   * looks like a file upload (coming from $_FILE).
+   */
+  protected function checkTaintedValues($values)
+  {
+    foreach ($values as $name => $value)
+    {
+      if (!is_array($value)) {
+        continue;
+      }
+
+      if (isset($value['tmp_name'])) {
+        throw new InvalidArgumentException('Do not try to fake a file upload.');
+      }
+
+      $this->checkTaintedValues($value);
+    }
+  }
-}

branches/1.4/test/unit/form/sfFormTest.php

@@ -11 +11 @@
-require_once(dirname(__FILE__).'/../../bootstrap/unit.php');
-
-3
+5
-
-class FormTest extends sfForm
@@ -980 +980 @@
-$f->bind(array('5' => 'bound'));
-$t->is_deeply($f->getFormFieldSchema()->getValue(), array('5' => 'bound'), '->getFormFieldSchema() includes bound numeric fields');
+
+// bind with a simulated file upload in the POST array
+$f = new FormTest();
+try
+{
+  $f->bind(array(
+    'file' => array(
+      'name' => 'foo.txt',
+      'type' => 'text/plain',
+      'tmp_name' => 'somefile',
+      'error' => 0,
+      'size' => 10,
+     ),
+  ));
+  $t->fail('Cannot fake a file upload with a POST');
+}
+catch (InvalidArgumentException $e)
+{
+  $t->pass('Cannot fake a file upload with a POST');
+}
+
+$f = new FormTest();
+try
+{
+  $f->bind(array(
+      'foo' => array(
+        'bar' => array(
+          'file' => array(
+            'name' => 'foo.txt',
+            'type' => 'text/plain',
+            'tmp_name' => 'somefile',
+            'error' => 0,
+            'size' => 10,
+          ),
+        ),
+      ),
+  ));
+  $t->fail('Cannot fake a file upload with a POST');
+}
+catch (InvalidArgumentException $e)
+{
+  $t->pass('Cannot fake a file upload with a POST');
+}