| Línea 22... |
Línea 22... |
| 22 |
* @package core
|
22 |
* @package core
|
| 23 |
* @category test
|
23 |
* @category test
|
| 24 |
* @copyright 2019 Ryan Wyllie <ryan@moodle.com>
|
24 |
* @copyright 2019 Ryan Wyllie <ryan@moodle.com>
|
| 25 |
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
|
25 |
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
|
| 26 |
*/
|
26 |
*/
|
| 27 |
class core_renderer_template_exploit_test extends \advanced_testcase {
|
27 |
final class core_renderer_template_exploit_test extends \advanced_testcase {
|
| 28 |
/**
|
28 |
/**
|
| 29 |
* Test cases to confirm that blacklisted helpers are stripped from the source
|
29 |
* Test cases to confirm that blacklisted helpers are stripped from the source
|
| 30 |
* text by the helper before being passed to other another helper. This prevents
|
30 |
* text by the helper before being passed to other another helper. This prevents
|
| 31 |
* nested calls to helpers.
|
31 |
* nested calls to helpers.
|
| 32 |
*/
|
32 |
*/
|
| 33 |
public function get_template_testcases() {
|
33 |
public static function get_template_testcases(): array {
|
| 34 |
// Different helper implementations to test various combinations of nested
|
34 |
// Different helper implementations to test various combinations of nested
|
| 35 |
// calls to render the templates.
|
35 |
// calls to render the templates.
|
| 36 |
$norender = function($text) {
|
36 |
$norender = function($text) {
|
| 37 |
return $text;
|
37 |
return $text;
|
| 38 |
};
|
38 |
};
|
| Línea 385... |
Línea 385... |
| 385 |
];
|
385 |
];
|
| 386 |
}
|
386 |
}
|
| Línea 387... |
Línea 387... |
| 387 |
|
387 |
|
| 388 |
/**
|
388 |
/**
|
| 389 |
* Test that the mustache_helper_collection class correctly strips
|
389 |
* Test that the mustache_helper_collection class correctly strips
|
| 390 |
* @dataProvider get_template_testcases()
|
390 |
* @dataProvider get_template_testcases
|
| 391 |
* @param array $templates The template to add
|
391 |
* @param array $templates The template to add
|
| 392 |
* @param string $torender The name of the template to render
|
392 |
* @param string $torender The name of the template to render
|
| 393 |
* @param array $context The template context
|
393 |
* @param array $context The template context
|
| 394 |
* @param array $helpers Mustache helpers to add
|
394 |
* @param array $helpers Mustache helpers to add
|