From 1221c736f9a90756d47ea6d28320b6b83602dd2a Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Tue, 7 May 2024 04:04:07 +0200
Subject: Adding debian version 2.4.38-3+deb10u8.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 debian/perl-framework/t/security/CVE-2004-0959.t | 56 ++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 debian/perl-framework/t/security/CVE-2004-0959.t

(limited to 'debian/perl-framework/t/security/CVE-2004-0959.t')

diff --git a/debian/perl-framework/t/security/CVE-2004-0959.t b/debian/perl-framework/t/security/CVE-2004-0959.t
new file mode 100644
index 0000000..fb15e80
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0959.t
@@ -0,0 +1,56 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 6, need 'LWP', { "PHP not installed", \&need_php };
+
+use HTTP::Message;
+
+my $url = Apache::TestRequest::resolve_url("/security/CAN-2004-0959.php");
+
+sub multipart
+{
+    my $name = shift;
+    my $filename = shift;
+    my $ctype = shift;
+    my $extra = shift;
+    my $req = HTTP::Request->new(POST => $url);
+    
+    $req->header(Content_Type => 'multipart/form-data; boundary=XXXX');
+    
+    $req->content("--XXXX\n".
+                  "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\n\n".
+                  "30000\n".
+                  "--XXXX\n".
+                  "Content-Disposition: form-data; name=\"".$name."\"; filename=\"".$filename."\"\n".
+                  "Content-Type: ".$ctype."\n\n".
+                  "fish\n");
+
+    $req->add_content($extra) if $extra;
+
+    $req->add_content("--XXXX--\n");
+
+    Apache::TestRequest::user_agent->request($req);
+}
+
+my $resp = multipart("user_file", "fish.php", "text/plain");
+ok t_cmp($resp->code, 200, "POST request success");
+ok t_cmp($resp->content, "fish.php", "filename parsed safely");
+
+$resp = multipart("user_file", "../../fish.php", "text/plain");
+ok t_cmp($resp->code, 200, "POST request success");
+ok t_cmp($resp->content, "fish.php", "filename parsed safely");
+
+$resp = multipart
+    ("user[file[name]123", "good.php", "/tmp/passt.php",
+     "--XXXX\n".
+     "Content-Disposition: form-data; name=\"user[file[type]123\"; filename=\"vg\"\n".
+     "Content-Type: text/plain\n\n".
+     "fishfood\n");
+
+ok t_cmp($resp->code, 200, "POST request success");
+ok t_cmp($resp->content, "FAILED", "filename parsed safely");
+
-- 
cgit v1.2.3