Gecko [ admjudic.com.br ]

Name	Size	Permission
analytics	[ DIR ]	drwxr-xr-x
behat	[ DIR ]	drwxr-xr-x
content	[ DIR ]	drwxr-xr-x
event	[ DIR ]	drwxr-xr-x
external	[ DIR ]	drwxr-xr-x
fixtures	[ DIR ]	drwxr-xr-x
other	[ DIR ]	drwxr-xr-x
output	[ DIR ]	drwxr-xr-x
performance	[ DIR ]	drwxr-xr-x
plugininfo	[ DIR ]	drwxr-xr-x
accesslib_has_capability_test....	29.73 KB	-rw-rw-r--
accesslib_test.php	219.29 KB	-rw-rw-r--
adhoc_task_test.php	18.44 KB	-rw-rw-r--
adminlib_test.php	4.38 KB	-rw-rw-r--
admintree_test.php	17.32 KB	-rw-r--r--
ajaxlib_test.php	4.36 KB	-rw-rw-r--
analysers_test.php	12.95 KB	-rw-r--r--
antivirus_test.php	8.69 KB	-rw-rw-r--
authlib_test.php	19.91 KB	-rw-r--r--
blocklib_test.php	35.27 KB	-rw-rw-r--
calendar_cron_task_test.php	2.69 KB	-rw-rw-r--
check_test.php	1.97 KB	-rw-r--r--
client_test.php	4.34 KB	-rw-r--r--
collator_test.php	11.99 KB	-rw-r--r--
completion_daily_task_test.php	5.24 KB	-rw-r--r--
completionlib_test.php	62.1 KB	-rw-rw-r--
component_test.php	40.17 KB	-rw-rw-r--
componentlib_test.php	6.64 KB	-rw-r--r--
configonlylib_test.php	6.15 KB	-rw-r--r--
content_test.php	4.77 KB	-rw-r--r--
core_media_player_native_test....	6.54 KB	-rw-r--r--
core_renderer_template_exploit...	17.28 KB	-rw-r--r--
coverage.php	1.93 KB	-rw-rw-r--
cronlib_test.php	6.89 KB	-rw-r--r--
csslib_test.php	1.79 KB	-rw-r--r--
csvclass_test.php	5.57 KB	-rw-r--r--
curl_security_helper_test.php	14.71 KB	-rw-r--r--
customcontext_test.php	3.79 KB	-rw-r--r--
dataformat_test.php	3.74 KB	-rw-r--r--
datalib_test.php	47.8 KB	-rw-r--r--
datalib_update_with_unique_ind...	6.31 KB	-rw-r--r--
date_legacy_test.php	13.9 KB	-rw-r--r--
date_test.php	24.48 KB	-rw-rw-r--
editorlib_test.php	2.01 KB	-rw-r--r--
encryption_test.php	8.68 KB	-rw-r--r--
environment_test.php	8.54 KB	-rw-r--r--
event_context_locked_test.php	4.11 KB	-rw-r--r--
event_course_module_instance_l...	2.7 KB	-rw-r--r--
event_course_module_viewed.php	3.33 KB	-rw-r--r--
event_deprecated_test.php	1.49 KB	-rw-r--r--
event_grade_deleted_test.php	3.25 KB	-rw-r--r--
event_profile_field_test.php	12.44 KB	-rw-r--r--
event_unknown_logged_test.php	1.92 KB	-rw-r--r--
event_user_graded_test.php	10.07 KB	-rw-r--r--
event_user_password_updated_te...	2.89 KB	-rw-r--r--
exporter_test.php	11.02 KB	-rw-r--r--
externallib_test.php	29.7 KB	-rw-r--r--
filelib_test.php	70.92 KB	-rw-rw-r--
filestorage_zip_archive_test.p...	2.75 KB	-rw-r--r--
filetypes_test.php	10.2 KB	-rw-r--r--
filter_manager_test.php	3.48 KB	-rw-r--r--
filterlib_test.php	36.72 KB	-rw-r--r--
formslib_test.php	39.6 KB	-rw-r--r--
gdlib_test.php	5.92 KB	-rw-r--r--
googlelib_test.php	1.54 KB	-rw-r--r--
gradelib_test.php	9.74 KB	-rw-r--r--
grades_externallib_test.php	24.66 KB	-rw-rw-r--
grading_externallib_test.php	26.27 KB	-rw-r--r--
grouplib_test.php	84.23 KB	-rw-rw-r--
h5p_clean_orphaned_records_tas...	3.12 KB	-rw-r--r--
h5p_get_content_types_task_tes...	2.69 KB	-rw-r--r--
html2text_test.php	7.58 KB	-rw-r--r--
html_writer_test.php	8.74 KB	-rw-rw-r--
htmlpurifier_test.php	22.67 KB	-rw-r--r--
ip_utils_test.php	14.27 KB	-rw-r--r--
jquery_test.php	1.76 KB	-rw-r--r--
ldaplib_test.php	17.72 KB	-rw-r--r--
licenselib_test.php	11.58 KB	-rw-r--r--
lock_config_test.php	3.39 KB	-rw-r--r--
lock_test.php	5.5 KB	-rw-r--r--
markdown_test.php	2.45 KB	-rw-r--r--
mathslib_test.php	11.12 KB	-rw-r--r--
medialib_test.php	20.19 KB	-rw-rw-r--
message_test.php	12.46 KB	-rw-rw-r--
messageinbound_test.php	5.89 KB	-rw-r--r--
messagelib_test.php	56.39 KB	-rw-rw-r--
minify_test.php	3.14 KB	-rw-r--r--
modinfolib_test.php	44.15 KB	-rw-rw-r--
moodle_page_test.php	29.58 KB	-rw-rw-r--
moodle_url_test.php	12.85 KB	-rw-r--r--
moodlelib_test.php	216.85 KB	-rw-rw-r--
mustache_template_finder_test....	7.4 KB	-rw-r--r--
mustache_template_source_loade...	18.06 KB	-rw-r--r--
myprofilelib_test.php	10.44 KB	-rw-r--r--
navigationlib_test.php	26.28 KB	-rw-rw-r--
notification_test.php	4.61 KB	-rw-r--r--
oauth2_test.php	17.57 KB	-rw-r--r--
output_mustache_helper_collect...	8.09 KB	-rw-r--r--
outputcomponents_test.php	29.67 KB	-rw-r--r--
outputfactories_test.php	6.8 KB	-rw-r--r--
outputrequirementslib_test.php	5.38 KB	-rw-r--r--
pdflib_test.php	1.51 KB	-rw-r--r--
persistent_test.php	19.95 KB	-rw-rw-r--
plugin_manager_test.php	27.39 KB	-rw-r--r--
portfoliolib_test.php	8.4 KB	-rw-r--r--
progress_display_test.php	3.75 KB	-rw-r--r--
progress_test.php	14.48 KB	-rw-r--r--
qrcode_test.php	1.88 KB	-rw-r--r--
questionlib_test.php	96.9 KB	-rw-rw-r--
regex_test.php	1.88 KB	-rw-r--r--
report_helper_test.php	3.68 KB	-rw-rw-r--
requirejs_test.php	3.73 KB	-rw-r--r--
rsslib_test.php	6.9 KB	-rw-r--r--
rtlcss_test.php	56.86 KB	-rw-r--r--
sample_questions.ser	141.76 KB	-rw-r--r--
sample_questions.xml	102.62 KB	-rw-r--r--
sample_questions_with_old_imag...	4.85 KB	-rw-r--r--
sample_questions_with_old_imag...	4.08 KB	-rw-r--r--
sample_questions_wrong.xml	102.57 KB	-rw-r--r--
scheduled_task_test.php	29.98 KB	-rw-rw-r--
scss_test.php	4.26 KB	-rw-r--r--
session_manager_test.php	33.96 KB	-rw-r--r--
session_redis_test.php	13.27 KB	-rw-r--r--
sessionlib_test.php	11.86 KB	-rw-r--r--
setuplib_test.php	19.63 KB	-rw-r--r--
statslib_test.php	26.75 KB	-rw-r--r--
string_manager_standard_test.p...	10.05 KB	-rw-rw-r--
tablelib_test.php	23.53 KB	-rw-r--r--
task_database_logger_test.php	20.15 KB	-rw-r--r--
task_logging_test.php	17.31 KB	-rw-r--r--
task_manager_test.php	11.2 KB	-rw-r--r--
task_running_test.php	6.58 KB	-rw-r--r--
text_test.php	21.09 KB	-rw-rw-r--
theme_config_test.php	9.81 KB	-rw-rw-r--
time_splittings_test.php	15.09 KB	-rw-r--r--
update_api_test.php	6.75 KB	-rw-r--r--
update_checker_test.php	10.86 KB	-rw-r--r--
update_code_manager_test.php	9.06 KB	-rw-r--r--
update_validator_test.php	18.44 KB	-rw-r--r--
upgrade_util_test.php	5.65 KB	-rw-r--r--
upgradelib_test.php	69.1 KB	-rw-rw-r--
user_menu_test.php	3.82 KB	-rw-rw-r--
user_test.php	32.36 KB	-rw-rw-r--
useragent_test.php	83.88 KB	-rw-rw-r--
weblib_format_text_test.php	12.11 KB	-rw-r--r--
weblib_test.php	35.1 KB	-rw-rw-r--
xhprof_test.php	3.32 KB	-rw-r--r--
xhtml_container_stack_test.php	4.16 KB	-rw-r--r--
xmlize_test.php	2.72 KB	-rw-r--r--

Code Editor : core_renderer_template_exploit_test.php

<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

/**
 * Unit tests for core renderer render template exploit.
 *
 * @copyright 2019 Ryan Wyllie <ryan@moodle.com>
 * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

defined('MOODLE_INTERNAL') || die();

/**
 * Unit tests for core renderer render template exploit.
 */
class core_renderer_template_exploit_testcase extends advanced_testcase {
    /**
     * Test cases to confirm that blacklisted helpers are stripped from the source
     * text by the helper before being passed to other another helper. This prevents
     * nested calls to helpers.
     */
    public function get_template_testcases() {
        // Different helper implementations to test various combinations of nested
        // calls to render the templates.
        $norender = function($text) {
            return $text;
        };
        $singlerender = function($text, $helper) {
            return $helper->render($text);
        };
        $recursiverender = function($text, $helper) {
            $result = $helper->render($text);

while (strpos($result, '{{') != false) {
                $result = $helper->render($result);
            }

return $result;
        };

return [
            'nested JS helper' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{#js}} some nasty JS {{/js}}{{/testpix}}',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'other nested helper' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{#test1}} some text {{/test1}}{{/testpix}}',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $singlerender,
                    'test1' => $norender,
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,  some text',
                'include' => false
            ],
            'double nested helper' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{#test1}} some text {{#js}} some nasty JS {{/js}} {{/test1}}{{/testpix}}',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $singlerender,
                    'test1' => $norender,
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,  some text',
                'include' => false
            ],
            'js helper not nested' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, some text {{/testpix}}{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, some text',
                'include' => true
            ],
            'js in context not in helper' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{/testpix}}{{hack}}',
                ],
                'torender' => 'test',
                'context' => [
                    'hack' => '{{#js}} some nasty JS {{/js}}'
                ],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, {{#js}} some nasty JS {{/js}}',
                'include' => false
            ],
            'js in context' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{hack}}{{/testpix}}',
                ],
                'torender' => 'test',
                'context' => [
                    'hack' => '{{#js}} some nasty JS {{/js}}'
                ],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'js in context double depth with single render' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{first}}{{/testpix}}',
                ],
                'torender' => 'test',
                'context' => [
                    'first' => '{{second}}',
                    'second' => '{{#js}} some nasty JS {{/js}}'
                ],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, {{#js}} some nasty JS {{/js}}',
                'include' => false
            ],
            'js in context double depth with recursive render' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{first}}{{/testpix}}',
                ],
                'torender' => 'test',
                'context' => [
                    'first' => '{{second}}',
                    'second' => '{{#js}} some nasty JS {{/js}}'
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'partial' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, blah{{/testpix}}, {{> test2}}',
                    'test2' => 'some content',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, blah, some content',
                'include' => false
            ],
            'partial nested' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{> test2}}{{/testpix}}',
                    'test2' => 'some content',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, some content',
                'include' => false
            ],
            'partial with js' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, blah{{/testpix}}, {{> test2}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, blah,',
                'include' => true
            ],
            'partial nested with js' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{> test2}}{{/testpix}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'partial with js from context' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, blah{{/testpix}}, {{{foo}}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [
                    'foo' => '{{> test2}}'
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, blah, {{> test2}}',
                'include' => false
            ],
            'partial nested with js from context recursive render' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [
                    'foo' => '{{> test2}}'
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'partial nested with js from context single render' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [
                    'foo' => '{{> test2}}'
                ],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'partial double nested with js from context single render' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [
                    'foo' => '{{{bar}}}',
                    'bar' => '{{> test2}}'
                ],
                'helpers' => [
                    'testpix' => $singlerender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, {{> test2}}',
                'include' => false
            ],
            'partial double nested with js from context recursive render' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{foo}}{{/testpix}}',
                    'test2' => '{{#js}} some nasty JS {{/js}}',
                ],
                'torender' => 'test',
                'context' => [
                    'foo' => '{{bar}}',
                    'bar' => '{{> test2}}'
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ],
            'array context depth 1' => [
                'templates' => [
                    'test' => '{{#items}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/items}}'
                ],
                'torender' => 'test',
                'context' => [
                    'items' => [
                        'legit',
                        '{{#js}}some nasty JS{{/js}}'
                    ]
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, legit core, move,',
                'include' => false
            ],
            'array context depth 2' => [
                'templates' => [
                    'test' => '{{#items}}{{#subitems}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/subitems}}{{/items}}'
                ],
                'torender' => 'test',
                'context' => [
                    'items' => [
                        [
                            'subitems' => [
                                'legit',
                                '{{#js}}some nasty JS{{/js}}'
                            ]
                        ],
                    ]
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, legit core, move,',
                'include' => false
            ],
            'object context depth 1' => [
                'templates' => [
                    'test' => '{{#items}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/items}}'
                ],
                'torender' => 'test',
                'context' => (object) [
                    'items' => [
                        'legit',
                        '{{#js}}some nasty JS{{/js}}'
                    ]
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, legit core, move,',
                'include' => false
            ],
            'object context depth 2' => [
                'templates' => [
                    'test' => '{{#items}}{{#subitems}}{{#testpix}} core, move, {{.}}{{/testpix}}{{/subitems}}{{/items}}'
                ],
                'torender' => 'test',
                'context' => (object) [
                    'items' => [
                        (object) [
                            'subitems' => [
                                'legit',
                                '{{#js}}some nasty JS{{/js}}'
                            ]
                        ],
                    ]
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move, legit core, move,',
                'include' => false
            ],
            'change delimeters' => [
                'templates' => [
                    'test' => '{{#testpix}} core, move, {{{foo}}}{{/testpix}}'
                ],
                'torender' => 'test',
                'context' => [
                    'foo' => '{{=<% %>=}} <%#js%>some nasty JS,<%/js%>'
                ],
                'helpers' => [
                    'testpix' => $recursiverender
                ],
                'js' => 'some nasty JS',
                'expected' => 'core, move,',
                'include' => false
            ]
        ];
    }

/**
     * Test that the mustache_helper_collection class correctly strips
     * @dataProvider get_template_testcases()
     * @param string $templates The template to add
     * @param string $torender The name of the template to render
     * @param array $context The template context
     * @param array $helpers Mustache helpers to add
     * @param string $js The JS string from the template
     * @param string $expected The expected output of the string after stripping JS
     * @param bool $include If the JS should be added to the page or not
     */
    public function test_core_mustache_engine_strips_js_helper(
        $templates,
        $torender,
        $context,
        $helpers,
        $js,
        $expected,
        $include
    ) {
        $page = new \moodle_page();
        $renderer = $page->get_renderer('core');

// Get the mustache engine from the renderer.
        $reflection = new \ReflectionMethod($renderer, 'get_mustache');
        $reflection->setAccessible(true);
        $engine = $reflection->invoke($renderer);

// Swap the loader out with an array loader so that we can set some
        // inline templates for testing.
        $loader = new \Mustache_Loader_ArrayLoader([]);
        $engine->setLoader($loader);

// Add our test helpers.
        $helpercollection = $engine->getHelpers();
        foreach ($helpers as $name => $function) {
            $helpercollection->add($name, $function);
        }

// Add our test template to be rendered.
        foreach ($templates as $name => $template) {
            $loader->setTemplate($name, $template);
        }

// Confirm that the rendered template matches what we expect.
        $this->assertEquals($expected, trim($engine->render($torender, $context)));

if ($include) {
            // Confirm that the JS was added to the page.
            $this->assertStringContainsString($js, $page->requires->get_end_code());
        } else {
            // Confirm that the JS wasn't added to the page.
            $this->assertStringNotContainsString($js, $page->requires->get_end_code());
        }
    }
}

${this.title}

Code Editor : core_renderer_template_exploit_test.php