Skip to content

Instantly share code, notes, and snippets.

@dotandimet
Created March 6, 2011 15:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dotandimet/857366 to your computer and use it in GitHub Desktop.
Save dotandimet/857366 to your computer and use it in GitHub Desktop.
test for Mojo::Loader arbitrary code execution
#!/usr/bin/env perl
use warnings;
use strict;
# Mojo::Loader executes arbitray code - via vti
# perl -MMojo::Loader -e 'Mojo::Loader->load(qq{Mojo::Loader;print "nice feature!"})'
# http://twitter.com/#!/vtivti/status/44408695613952000
use Test::More tests => 2;
use Mojo::Loader;
# output redirection copy-paste credit
# http://stackoverflow.com/questions/1538260/how-can-i-unit-test-perl-functions-that-print-to-the-screen
sub capture_stdout {
my $sub = shift;
my $stdout;
{
local *STDOUT;
open STDOUT, '>', \$stdout
or die "Cannot open STDOUT to a scalar: $!";
$sub->(@_);
close STDOUT
or die "Cannot close redirected STDOUT: $!";
}
return $stdout;
}
# current behaviour:
#
# is(
# capture_stdout(
# sub { Mojo::Loader->load(qq{Mojo::Loader; print "Nice Feature";}); }
# ),
# "Nice Feature",
# "loader executes arbitrary code"
# );
# is(capture_stdout(sub { Mojo::Loader->load(qq{print "Nice Feature";}); }),
# "Nice Feature", "loader executes arbitrary code no module");
# not sure what the correct behaviour should be - silently avoid code execution or
# throw exception?
#
is(
capture_stdout(
sub { Mojo::Loader->load(qq{Mojo::Loader; print "Nice Feature";}); }
),
"",
"loader executes arbitrary code"
);
is(capture_stdout(sub { Mojo::Loader->load(qq{print "Nice Feature";}); }),
"", "loader executes arbitrary code no module");
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment