Adding debian version 2.4.57-2.debian/2.4.57-2

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

23 files changed, 1852 insertions, 0 deletions

diff --git a/debian/perl-framework/t/security/CVE-2003-0542.t b/debian/perl-framework/t/security/CVE-2003-0542.t
new file mode 100644
index 0000000..20497d8
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2003-0542.t
@@ -0,0 +1,15 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 1, need 'rewrite';
+
+my $rc;
+
+$rc = GET_RC "/security/CAN-2003-0542/nonesuch";
+
+ok t_cmp($rc, 404, "CAN-2003-0542 test case");
+
diff --git a/debian/perl-framework/t/security/CVE-2004-0747.t b/debian/perl-framework/t/security/CVE-2004-0747.t
new file mode 100644
index 0000000..414a844
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0747.t
@@ -0,0 +1,34 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 1, need_apache(2);
+
+my $rc;
+
+$rc = GET_RC "/security/CAN-2004-0747/";
+
+# This test used to check for SegFaults when expanding variables
+# inside a .htaccess file. 
+# Only, the code trying to parse the generated AuthName will 
+# fail with a 500 when the string exceeds a certain length (at least on OS X)
+#
+# So, in case of a 500 return, we check for a proper body and assume
+# that the failure was graceful and not a crash.
+#
+# The alternative would be to expand a env var under our control in .htacess
+# for this test, so that the outcome is not depending on the env of the person
+# starting the test.
+#
+if ($rc == 500) {
+    my $body = GET_BODY "/security/CAN-2004-0747/";
+    if (length $body > 0) {
+        $rc = 200;
+    }
+}
+
+ok t_cmp($rc, 200, "CAN-2004-0747 ap_resolve_env test case");
+
diff --git a/debian/perl-framework/t/security/CVE-2004-0811.t b/debian/perl-framework/t/security/CVE-2004-0811.t
new file mode 100644
index 0000000..c0c7661
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0811.t
@@ -0,0 +1,21 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 8, need_apache(2);
+
+my $rc;
+
+foreach my $y (1..4) {
+    $rc = GET_RC("/security/CAN-2004-0811/sub/");
+    ok t_cmp($rc, 200, "subdir access allowed");
+}
+
+foreach my $z (1..4) {
+    $rc = GET_RC("/security/CAN-2004-0811/");
+    ok t_cmp($rc, 401, "topdir access denied");
+}
+    
diff --git a/debian/perl-framework/t/security/CVE-2004-0940.t b/debian/perl-framework/t/security/CVE-2004-0940.t
new file mode 100644
index 0000000..740b3f3
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0940.t
@@ -0,0 +1,12 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 1, need_module 'include';
+
+# 1.3.32 and earlier will segfault
+ok t_cmp(GET_RC("/security/CAN-2004-0940.shtml"), 
+         200, 'response was 200');
diff --git a/debian/perl-framework/t/security/CVE-2004-0942.t b/debian/perl-framework/t/security/CVE-2004-0942.t
new file mode 100644
index 0000000..9810480
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0942.t
@@ -0,0 +1,36 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+$SIG{PIPE} = 'IGNORE';
+
+plan tests => 2, need_min_apache_version('2.0');
+
+my $sock = Apache::TestRequest::vhost_socket('default');
+ok $sock;
+
+# This is a test for CAN-2004-0942 albeit a pretty bad one:
+# CAN-2004-0942 is a memory leak in the <=2.0.52 logic for handling
+# whitespace in folded headers.  This test tests that a folded header
+# which, including whitespace, exceeds the field length limit, gets a
+# 400 response.  A better httpd implementation could handle such
+# headers without the memory leak, yet would fail this test.
+
+Apache::TestRequest::socket_trace($sock);
+
+$sock->print("GET /index.html HTTP/1.0\r\n");
+
+my $n = $sock->print("Hello:\r\n");
+foreach (1..100) {
+    $n = $sock->print(" "x500 . "\r\n") if $sock->connected;
+}
+
+$sock->print("\r\n") if $sock->connected;
+
+my $line = Apache::TestRequest::getline($sock) || '';
+
+ok t_cmp($line, qr{^HTTP/1\.. 400}, "request was refused");
+
diff --git a/debian/perl-framework/t/security/CVE-2004-0958.t b/debian/perl-framework/t/security/CVE-2004-0958.t
new file mode 100644
index 0000000..87e8d39
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0958.t
@@ -0,0 +1,37 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my %queries =
+(
+
+ "foo[bar=1" => qr/\[foo_bar\] => 1\n/,
+ "foo bar=2" => qr/\[foo_bar\] => 2\n/,
+ "foo. .bar=3" => qr/\[foo___bar\] => 3\n/,
+ "foobar[=3" => qr/\[foobar_\] => 3\n/,
+
+ "foo[g][=1" => qr/\[g\] => 1\n/, # corruption pre-5.0.2/4.3.9
+ "foo[][=2" => qr/\[0\] => 2\n/, # segfault in 5.0.2/4.3.9
+
+ "foo[][[[[[=3" => qr/\[0\] => 3\n/,
+ "foo[][][][][]=5" => qr/\[0\] => 5\n/,
+
+ "foo[j]bar=6" => qr/\[j\] => 6\n/,
+
+
+### tests which have dubious results currently:
+# "foo[[[[[[[h]=4" => qr/\[0\] => 4\n/,
+# "foo[ ]=7" => qr/\[baz\] => 7\n/,
+# "foo[  ]=7" => qr/\[baz\] => 7\n/,
+
+ );
+
+plan tests => (keys %queries) * 1, need_php;
+
+foreach (keys %queries) {
+    my $actual = GET_BODY "/security/CAN-2004-0958.php?".$_;
+    ok t_cmp($actual, $queries{$_}, "query for $_");
+}
diff --git a/debian/perl-framework/t/security/CVE-2004-0959.t b/debian/perl-framework/t/security/CVE-2004-0959.t
new file mode 100644
index 0000000..fb15e80
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2004-0959.t
@@ -0,0 +1,56 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 6, need 'LWP', { "PHP not installed", \&need_php };
+
+use HTTP::Message;
+
+my $url = Apache::TestRequest::resolve_url("/security/CAN-2004-0959.php");
+
+sub multipart
+{
+    my $name = shift;
+    my $filename = shift;
+    my $ctype = shift;
+    my $extra = shift;
+    my $req = HTTP::Request->new(POST => $url);
+    
+    $req->header(Content_Type => 'multipart/form-data; boundary=XXXX');
+    
+    $req->content("--XXXX\n".
+                  "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\n\n".
+                  "30000\n".
+                  "--XXXX\n".
+                  "Content-Disposition: form-data; name=\"".$name."\"; filename=\"".$filename."\"\n".
+                  "Content-Type: ".$ctype."\n\n".
+                  "fish\n");
+
+    $req->add_content($extra) if $extra;
+
+    $req->add_content("--XXXX--\n");
+
+    Apache::TestRequest::user_agent->request($req);
+}
+
+my $resp = multipart("user_file", "fish.php", "text/plain");
+ok t_cmp($resp->code, 200, "POST request success");
+ok t_cmp($resp->content, "fish.php", "filename parsed safely");
+
+$resp = multipart("user_file", "../../fish.php", "text/plain");
+ok t_cmp($resp->code, 200, "POST request success");
+ok t_cmp($resp->content, "fish.php", "filename parsed safely");
+
+$resp = multipart
+    ("user[file[name]123", "good.php", "/tmp/passt.php",
+     "--XXXX\n".
+     "Content-Disposition: form-data; name=\"user[file[type]123\"; filename=\"vg\"\n".
+     "Content-Type: text/plain\n\n".
+     "fishfood\n");
+
+ok t_cmp($resp->code, 200, "POST request success");
+ok t_cmp($resp->content, "FAILED", "filename parsed safely");
+
diff --git a/debian/perl-framework/t/security/CVE-2005-2491.t b/debian/perl-framework/t/security/CVE-2005-2491.t
new file mode 100644
index 0000000..7085fb8
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2005-2491.t
@@ -0,0 +1,21 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 2 * 2, need 'rewrite';
+
+foreach my $dir ("one/", "two/") {
+    my $r = GET("/security/CAN-2005-2491/" . $dir);
+
+    # LWP will generate the annoying fake-500 response if the server
+    # segfaults before generating its own 500 response; check
+    # the response message explicitly to rule that out.
+
+    ok t_cmp($r->message, 'Internal Server Error',
+             'check that server did not segfault');
+
+    ok t_cmp($r->code, 500, "check for 500 response error");
+}
diff --git a/debian/perl-framework/t/security/CVE-2005-2700.t b/debian/perl-framework/t/security/CVE-2005-2700.t
new file mode 100644
index 0000000..6af7fae
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2005-2700.t
@@ -0,0 +1,25 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my $vars = Apache::Test::vars();
+
+plan tests => 2, need $vars->{ssl_module_name}, need_lwp,
+    qw(LWP::Protocol::https);
+
+Apache::TestRequest::user_agent_keepalive(0);
+Apache::TestRequest::scheme('https');
+Apache::TestRequest::module('ssl_optional_cc');
+
+my $r;
+
+$r = GET "/require/none/";
+
+ok t_cmp($r->code, 200, "access permitted without ccert");
+
+$r = GET "/require/any/";
+
+ok !t_cmp($r->code, 200, "access *not* permitted without ccert");
diff --git a/debian/perl-framework/t/security/CVE-2005-3352.t b/debian/perl-framework/t/security/CVE-2005-3352.t
new file mode 100644
index 0000000..b1881a9
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2005-3352.t
@@ -0,0 +1,23 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my $vars = Apache::Test::vars();
+
+plan tests => 2, need_imagemap;
+
+my $url = "/security/CVE-2005-3352.map";
+
+my $r = GET $url, Referer => '">http://fish/';
+
+ok t_cmp($r->code, 200, "response code is OK");
+
+if ((!have_min_apache_version('2.3') && have_min_apache_version('2.2.24')) ||
+    have_min_apache_version('2.4.4')) {
+    ok t_cmp($r->content, qr/%22%3e/, "referer was escaped");
+} else {
+    ok t_cmp($r->content, qr/\&quot/, "referer was escaped");
+}
diff --git a/debian/perl-framework/t/security/CVE-2005-3357.t b/debian/perl-framework/t/security/CVE-2005-3357.t
new file mode 100644
index 0000000..0124796
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2005-3357.t
@@ -0,0 +1,51 @@
+use strict;
+use warnings FATAL => 'all';
+
+# Test case for PR 33791.
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+BEGIN {
+   # prevent TestRequest from croaking on an HTTP/0.9 response
+   $ENV{APACHE_TEST_HTTP_09_OK} = 1;
+}
+
+my $vars = Apache::Test::vars();
+
+plan tests => 3, need $vars->{ssl_module_name}, need_lwp,
+    qw(LWP::Protocol::https);
+
+Apache::TestRequest::user_agent_keepalive(0);
+
+my $config = Apache::Test::config();
+
+Apache::TestRequest::module("ssl_pr33791");
+
+my $hostport = Apache::TestRequest::hostport();
+
+my $rurl = "http://" . $hostport . "/";
+
+t_debug("URL is $rurl");
+
+my $r = GET($rurl);
+
+my $proto = $r->protocol;
+
+ok $proto;
+
+if (!$proto) {
+    skip "server gave no response";
+} else {
+    if ($proto eq "HTTP/0.9") {
+        skip "server gave HTTP/0.9 response";
+    } elsif ($proto) {    
+        ok t_cmp($r->code,
+                 400,
+                 "Expected bad request from 'GET $rurl'"
+                 );
+    }
+}
+
+ok t_cmp($r->content, qr/welcome to localhost/, "errordoc content was served");
diff --git a/debian/perl-framework/t/security/CVE-2006-5752.t b/debian/perl-framework/t/security/CVE-2006-5752.t
new file mode 100644
index 0000000..911f59f
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2006-5752.t
@@ -0,0 +1,16 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 2, need_module 'status';
+
+my $r;
+
+$r = GET "/server-status";
+
+ok t_cmp($r->code, 200, "server-status gave response");
+
+ok t_cmp($r->header("Content-Type"), qr/charset=/, "response content-type had charset");
diff --git a/debian/perl-framework/t/security/CVE-2007-5000.t b/debian/perl-framework/t/security/CVE-2007-5000.t
new file mode 100644
index 0000000..8502378
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2007-5000.t
@@ -0,0 +1,18 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my $vars = Apache::Test::vars();
+
+plan tests => 2, need_imagemap;
+
+my $url = '/security/CVE-2005-3352.map/<foo>';
+
+my $r = GET $url;
+
+ok t_cmp($r->code, 200, "response code is OK");
+
+ok !t_cmp($r->content, qr/<foo>/, "URI was escaped in response");
diff --git a/debian/perl-framework/t/security/CVE-2007-6388.t b/debian/perl-framework/t/security/CVE-2007-6388.t
new file mode 100644
index 0000000..70ebb7d
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2007-6388.t
@@ -0,0 +1,18 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my $vars = Apache::Test::vars();
+
+plan tests => 2, need_module 'status';
+
+my $url = '/server-status?refresh=42;fish';
+
+my $r = GET $url;
+
+ok t_cmp($r->code, 200, "response code is OK");
+
+ok t_cmp($r->header('Refresh'), 42, "refresh parameter not echoed verbatim");
diff --git a/debian/perl-framework/t/security/CVE-2008-2364.t b/debian/perl-framework/t/security/CVE-2008-2364.t
new file mode 100644
index 0000000..46552ad
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2008-2364.t
@@ -0,0 +1,36 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+use Apache::TestConfig ();
+
+my $tests = 3;
+my $server_suppresses_interim = 1;
+if (!have_min_apache_version("2.4.10")) { 
+  $tests = 1;
+  $server_suppresses_interim = 0;
+}
+
+plan tests => $tests, need_module 'proxy';
+
+Apache::TestRequest::module("proxy_http_reverse");
+Apache::TestRequest::user_agent(requests_redirectable => 0);
+
+my $r = GET("/reverse/");
+ok t_cmp($r->code, 200, "reverse proxy to index.html");
+if (have_cgi) {
+  if ($server_suppresses_interim) {
+        # XXX: This doesn't work in 2.2.x w/o at least r1588519 because LWP 
+        # sees the unexpected interim response and stops.
+        $r = GET("/reverse/modules/cgi/nph-interim1.pl");
+        ok t_cmp($r->code, 200, "small number of interim responses - CVE-2008-2364");
+
+        $r = GET("/reverse/modules/cgi/nph-interim2.pl");
+        ok t_cmp($r->code, 502, "large number of interim responses - CVE-2008-2364");
+  }
+} else {
+    skip "skipping tests without CGI module" foreach (1..2);
+}
+
diff --git a/debian/perl-framework/t/security/CVE-2009-1195.t b/debian/perl-framework/t/security/CVE-2009-1195.t
new file mode 100644
index 0000000..70663c4
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2009-1195.t
@@ -0,0 +1,1120 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+
+plan tests => 221, need 'include', need_min_apache_version('2.2');
+
+Apache::TestRequest::module('mod_include'); #use this module's port
+
+my $r;
+my $body;
+
+### Test #1, context: Options None : AllowOverride Options=IncludesNoExec : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/1/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #1; 500 response expected");
+
+### Test #2, context: Options None : AllowOverride Options=IncludesNoExec : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/2/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #2; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #2");
+
+### Test #3, context: Options None : AllowOverride Options=IncludesNoExec : Options Includes
+
+$r = GET("/modules/include/ssi-exec/3/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #3; 500 response expected");
+
+### Test #4, context: Options None : AllowOverride Options=IncludesNoExec : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/4/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #4; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #4");
+
+### Test #5, context: Options None : AllowOverride Options=IncludesNoExec : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/5/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #5; 500 response expected");
+
+### Test #6, context: Options None : AllowOverride Options=IncludesNoExec : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/6/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #6; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #6");
+
+### Test #7, context: Options None : AllowOverride Options=IncludesNoExec : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/7/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #7; 500 response expected");
+
+### Test #8, context: Options None : AllowOverride Options=IncludesNoExec : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/8/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #8; 500 response expected");
+
+### Test #9, context: Options None : AllowOverride Options=IncludesNoExec : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/9/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #9; 500 response expected");
+
+### Test #10, context: Options None : AllowOverride Options=IncludesNoExec : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/10/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #10; 500 response expected");
+
+### Test #11, context: Options None : AllowOverride Options=Includes : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/11/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #11; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #11");
+
+### Test #12, context: Options None : AllowOverride Options=Includes : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/12/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #12; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #12");
+
+### Test #13, context: Options None : AllowOverride Options=Includes : Options Includes
+
+$r = GET("/modules/include/ssi-exec/13/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #13; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #13");
+
+### Test #14, context: Options None : AllowOverride Options=Includes : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/14/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #14; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #14");
+
+### Test #15, context: Options None : AllowOverride Options=Includes : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/15/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #15; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #15");
+
+### Test #16, context: Options None : AllowOverride Options=Includes : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/16/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #16; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #16");
+
+### Test #17, context: Options None : AllowOverride Options=Includes : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/17/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #17; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #17");
+
+### Test #18, context: Options None : AllowOverride Options=Includes : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/18/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #18; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #18");
+
+### Test #19, context: Options None : AllowOverride Options=Includes : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/19/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #19; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #19");
+
+### Test #20, context: Options None : AllowOverride Options=Includes : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/20/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #20; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #20");
+
+### Test #21, context: Options None : AllowOverride All : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/21/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #21; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #21");
+
+### Test #22, context: Options None : AllowOverride All : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/22/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #22; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #22");
+
+### Test #23, context: Options None : AllowOverride All : Options Includes
+
+$r = GET("/modules/include/ssi-exec/23/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #23; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #23");
+
+### Test #24, context: Options None : AllowOverride All : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/24/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #24; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #24");
+
+### Test #25, context: Options None : AllowOverride All : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/25/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #25; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #25");
+
+### Test #26, context: Options None : AllowOverride All : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/26/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #26; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #26");
+
+### Test #27, context: Options None : AllowOverride All : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/27/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #27; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #27");
+
+### Test #28, context: Options None : AllowOverride All : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/28/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #28; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #28");
+
+### Test #29, context: Options None : AllowOverride All : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/29/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #29; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #29");
+
+### Test #30, context: Options None : AllowOverride All : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/30/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #30; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #30");
+
+### Test #31, context: Options None : AllowOverride None : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/31/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #31; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #31");
+
+### Test #32, context: Options None : AllowOverride None : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/32/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #32; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #32");
+
+### Test #33, context: Options None : AllowOverride None : Options Includes
+
+$r = GET("/modules/include/ssi-exec/33/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #33; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #33");
+
+### Test #34, context: Options None : AllowOverride None : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/34/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #34; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #34");
+
+### Test #35, context: Options None : AllowOverride None : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/35/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #35; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #35");
+
+### Test #36, context: Options None : AllowOverride None : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/36/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #36; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #36");
+
+### Test #37, context: Options None : AllowOverride None : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/37/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #37; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #37");
+
+### Test #38, context: Options None : AllowOverride None : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/38/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #38; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #38");
+
+### Test #39, context: Options None : AllowOverride None : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/39/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #39; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #39");
+
+### Test #40, context: Options None : AllowOverride None : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/40/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #40; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #40");
+
+### Test #41, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/41/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #41; 500 response expected");
+
+### Test #42, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/42/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #42; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #42");
+
+### Test #43, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options Includes
+
+$r = GET("/modules/include/ssi-exec/43/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #43; 500 response expected");
+
+### Test #44, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/44/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #44; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #44");
+
+### Test #45, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/45/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #45; 500 response expected");
+
+### Test #46, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/46/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #46; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #46");
+
+### Test #47, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/47/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #47; 500 response expected");
+
+### Test #48, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/48/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #48; 500 response expected");
+
+### Test #49, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/49/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #49; 500 response expected");
+
+### Test #50, context: Options IncludesNoExec : AllowOverride Options=IncludesNoExec : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/50/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #50; 500 response expected");
+
+### Test #51, context: Options IncludesNoExec : AllowOverride Options=Includes : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/51/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #51; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #51");
+
+### Test #52, context: Options IncludesNoExec : AllowOverride Options=Includes : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/52/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #52; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #52");
+
+### Test #53, context: Options IncludesNoExec : AllowOverride Options=Includes : Options Includes
+
+$r = GET("/modules/include/ssi-exec/53/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #53; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #53");
+
+### Test #54, context: Options IncludesNoExec : AllowOverride Options=Includes : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/54/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #54; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #54");
+
+### Test #55, context: Options IncludesNoExec : AllowOverride Options=Includes : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/55/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #55; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #55");
+
+### Test #56, context: Options IncludesNoExec : AllowOverride Options=Includes : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/56/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #56; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #56");
+
+### Test #57, context: Options IncludesNoExec : AllowOverride Options=Includes : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/57/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #57; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #57");
+
+### Test #58, context: Options IncludesNoExec : AllowOverride Options=Includes : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/58/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #58; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #58");
+
+### Test #59, context: Options IncludesNoExec : AllowOverride Options=Includes : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/59/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #59; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #59");
+
+### Test #60, context: Options IncludesNoExec : AllowOverride Options=Includes : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/60/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #60; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #60");
+
+### Test #61, context: Options IncludesNoExec : AllowOverride All : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/61/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #61; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #61");
+
+### Test #62, context: Options IncludesNoExec : AllowOverride All : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/62/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #62; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #62");
+
+### Test #63, context: Options IncludesNoExec : AllowOverride All : Options Includes
+
+$r = GET("/modules/include/ssi-exec/63/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #63; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #63");
+
+### Test #64, context: Options IncludesNoExec : AllowOverride All : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/64/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #64; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #64");
+
+### Test #65, context: Options IncludesNoExec : AllowOverride All : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/65/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #65; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #65");
+
+### Test #66, context: Options IncludesNoExec : AllowOverride All : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/66/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #66; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #66");
+
+### Test #67, context: Options IncludesNoExec : AllowOverride All : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/67/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #67; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #67");
+
+### Test #68, context: Options IncludesNoExec : AllowOverride All : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/68/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #68; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #68");
+
+### Test #69, context: Options IncludesNoExec : AllowOverride All : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/69/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #69; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #69");
+
+### Test #70, context: Options IncludesNoExec : AllowOverride All : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/70/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #70; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #70");
+
+### Test #71, context: Options IncludesNoExec : AllowOverride None : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/71/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #71; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #71");
+
+### Test #72, context: Options IncludesNoExec : AllowOverride None : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/72/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #72; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #72");
+
+### Test #73, context: Options IncludesNoExec : AllowOverride None : Options Includes
+
+$r = GET("/modules/include/ssi-exec/73/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #73; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #73");
+
+### Test #74, context: Options IncludesNoExec : AllowOverride None : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/74/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #74; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #74");
+
+### Test #75, context: Options IncludesNoExec : AllowOverride None : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/75/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #75; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #75");
+
+### Test #76, context: Options IncludesNoExec : AllowOverride None : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/76/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #76; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #76");
+
+### Test #77, context: Options IncludesNoExec : AllowOverride None : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/77/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #77; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #77");
+
+### Test #78, context: Options IncludesNoExec : AllowOverride None : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/78/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #78; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #78");
+
+### Test #79, context: Options IncludesNoExec : AllowOverride None : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/79/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #79; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #79");
+
+### Test #80, context: Options IncludesNoExec : AllowOverride None : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/80/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #80; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #80");
+
+### Test #81, context: Options Includes : AllowOverride Options=IncludesNoExec : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/81/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #81; 500 response expected");
+
+### Test #82, context: Options Includes : AllowOverride Options=IncludesNoExec : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/82/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #82; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #82");
+
+### Test #83, context: Options Includes : AllowOverride Options=IncludesNoExec : Options Includes
+
+$r = GET("/modules/include/ssi-exec/83/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #83; 500 response expected");
+
+### Test #84, context: Options Includes : AllowOverride Options=IncludesNoExec : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/84/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #84; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #84");
+
+### Test #85, context: Options Includes : AllowOverride Options=IncludesNoExec : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/85/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #85; 500 response expected");
+
+### Test #86, context: Options Includes : AllowOverride Options=IncludesNoExec : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/86/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #86; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #86");
+
+### Test #87, context: Options Includes : AllowOverride Options=IncludesNoExec : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/87/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #87; 500 response expected");
+
+### Test #88, context: Options Includes : AllowOverride Options=IncludesNoExec : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/88/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #88; 500 response expected");
+
+### Test #89, context: Options Includes : AllowOverride Options=IncludesNoExec : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/89/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #89; 500 response expected");
+
+### Test #90, context: Options Includes : AllowOverride Options=IncludesNoExec : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/90/exec.shtml");
+ok t_cmp($r->code, 500, "Options should not be allowed for script #90; 500 response expected");
+
+### Test #91, context: Options Includes : AllowOverride Options=Includes : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/91/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #91; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #91");
+
+### Test #92, context: Options Includes : AllowOverride Options=Includes : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/92/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #92; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #92");
+
+### Test #93, context: Options Includes : AllowOverride Options=Includes : Options Includes
+
+$r = GET("/modules/include/ssi-exec/93/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #93; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #93");
+
+### Test #94, context: Options Includes : AllowOverride Options=Includes : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/94/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #94; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #94");
+
+### Test #95, context: Options Includes : AllowOverride Options=Includes : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/95/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #95; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #95");
+
+### Test #96, context: Options Includes : AllowOverride Options=Includes : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/96/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #96; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #96");
+
+### Test #97, context: Options Includes : AllowOverride Options=Includes : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/97/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #97; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #97");
+
+### Test #98, context: Options Includes : AllowOverride Options=Includes : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/98/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #98; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #98");
+
+### Test #99, context: Options Includes : AllowOverride Options=Includes : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/99/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #99; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #99");
+
+### Test #100, context: Options Includes : AllowOverride Options=Includes : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/100/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #100; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #100");
+
+### Test #101, context: Options Includes : AllowOverride All : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/101/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #101; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #101");
+
+### Test #102, context: Options Includes : AllowOverride All : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/102/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #102; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #102");
+
+### Test #103, context: Options Includes : AllowOverride All : Options Includes
+
+$r = GET("/modules/include/ssi-exec/103/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #103; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #103");
+
+### Test #104, context: Options Includes : AllowOverride All : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/104/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #104; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #104");
+
+### Test #105, context: Options Includes : AllowOverride All : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/105/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #105; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #105");
+
+### Test #106, context: Options Includes : AllowOverride All : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/106/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #106; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #106");
+
+### Test #107, context: Options Includes : AllowOverride All : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/107/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #107; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, '[an error occurred while processing this directive]', "SSI should be evaluated but exec not permitted for script #107");
+
+### Test #108, context: Options Includes : AllowOverride All : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/108/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #108; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #108");
+
+### Test #109, context: Options Includes : AllowOverride All : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/109/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #109; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #109");
+
+### Test #110, context: Options Includes : AllowOverride All : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/110/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #110; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, qr/--\#exec cgi=/, "SSI should not be evaluated for script #110");
+
+### Test #111, context: Options Includes : AllowOverride None : Options +Includes
+
+$r = GET("/modules/include/ssi-exec/111/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #111; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #111");
+
+### Test #112, context: Options Includes : AllowOverride None : Options +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/112/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #112; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #112");
+
+### Test #113, context: Options Includes : AllowOverride None : Options Includes
+
+$r = GET("/modules/include/ssi-exec/113/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #113; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #113");
+
+### Test #114, context: Options Includes : AllowOverride None : Options IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/114/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #114; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #114");
+
+### Test #115, context: Options Includes : AllowOverride None : Options -Includes
+
+$r = GET("/modules/include/ssi-exec/115/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #115; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #115");
+
+### Test #116, context: Options Includes : AllowOverride None : Options -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/116/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #116; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #116");
+
+### Test #117, context: Options Includes : AllowOverride None : Options -Includes +IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/117/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #117; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #117");
+
+### Test #118, context: Options Includes : AllowOverride None : Options +Includes -IncludesNoExec
+
+$r = GET("/modules/include/ssi-exec/118/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #118; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #118");
+
+### Test #119, context: Options Includes : AllowOverride None : Options -IncludesNoExec +Includes
+
+$r = GET("/modules/include/ssi-exec/119/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #119; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #119");
+
+### Test #120, context: Options Includes : AllowOverride None : Options +IncludesNoExec -Includes
+
+$r = GET("/modules/include/ssi-exec/120/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #120; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #120");
+
+### Test #121, context: Options Includes : AllowOverride None : No options in subdir, no .htaccess
+
+$r = GET("/modules/include/ssi-exec/121/subdir/exec.shtml");
+ok t_cmp($r->code, 200, "Options should be allowed for script #121; 200 response expected");
+
+$body = $r->content;
+chomp $body;
+
+ok t_cmp($body, 'perl cgi', "SSI should be evaluated with exec allowed for script #121");
+
diff --git a/debian/perl-framework/t/security/CVE-2009-1890.t b/debian/perl-framework/t/security/CVE-2009-1890.t
new file mode 100644
index 0000000..6ef46b2
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2009-1890.t
@@ -0,0 +1,65 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+use IO::Select;
+
+plan tests => 7, need [qw(mod_proxy proxy_http.c)];
+
+my $len = 100000;
+
+my $sock = Apache::TestRequest::vhost_socket('proxy_http_reverse');
+ok $sock && $sock->connected;
+
+my $req = 
+    "POST /reverse/modules/cgi/perl_echo.pl HTTP/1.0\r\n".
+    "Content-Length: 0" . $len . "\r\n".
+    "\r\n";
+
+ok $sock->print($req);
+
+my $half_body = 'x' x ($len/2);
+ok $sock->print($half_body);
+sleep(1);
+ok $sock->print($half_body);
+
+my $readable = IO::Select->new($sock)->can_read(10);
+ok $readable, 1, "timeout, server hung";
+if (!$readable) {
+    skip "server hung, not testing further", foreach(1..2);
+    exit(0);
+}
+
+my $line = Apache::TestRequest::getline($sock) || '';
+ok t_cmp($line, qr{^HTTP/1\.. 200}, "request was parsed");
+
+do {
+    $line = Apache::TestRequest::getline($sock) || '';
+    $line = super_chomp($line);
+    print "# header: $line\n";
+} until ($line eq "");
+
+my $buffer;
+while ($len > 0 && $sock->read($buffer, $len)) {
+    print "# got: $buffer\n";
+    $len -= length($buffer);
+    print "# remaining: $len\n";
+}
+
+ok t_cmp($len, 0, "read entire body");
+
+sub super_chomp {
+    my ($body) = shift;
+
+    ## super chomp - all leading and trailing \n (and \r for win32)
+    $body =~ s/^[\n\r]*//;
+    $body =~ s/[\n\r]*$//;
+    ## and all the rest change to spaces
+    $body =~ s/\n/ /g;
+    $body =~ s/\r//g; #rip out all remaining \r's
+
+    $body;
+}
diff --git a/debian/perl-framework/t/security/CVE-2009-3555.t b/debian/perl-framework/t/security/CVE-2009-3555.t
new file mode 100644
index 0000000..bd0c413
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2009-3555.t
@@ -0,0 +1,67 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+plan tests => 4, need 'ssl';
+
+# This test case attempts only one type of attack which is possible
+# due to the TLS renegotiation vulnerability, CVE-2009-3555.  A
+# specific defense against this attack was added to mod_ssl in
+# r891282.  For more information, see the dev@httpd thread beginning
+# at message ID <4B01BD20.1060300@adnovum.ch>.
+
+Apache::TestRequest::set_client_cert("client_ok");
+
+Apache::TestRequest::module('mod_ssl');
+
+my $sock = Apache::TestRequest::vhost_socket('mod_ssl');
+
+if ($sock && $sock->connected && $sock->get_sslversion() eq "TLSv1_3") {
+    skip "Skipping test for TLSv1.3" foreach(1..4);
+    exit;
+}
+
+ok $sock && $sock->connected;
+
+
+my $req = "GET /require/asf/ HTTP/1.1\r\n".
+   "Host: " . Apache::TestRequest::hostport() . "\r\n".
+    "\r\n".
+    "GET /this/is/a/prefix/injection/attack HTTP/1.0\r\n".
+    "Host: " . Apache::TestRequest::hostport() . "\r\n".
+    "\r\n";
+
+ok $sock->print($req);
+
+my $line = Apache::TestRequest::getline($sock) || '';
+
+ok t_cmp($line, qr{^HTTP/1\.. 200}, "read first response-line");
+
+my $rv = 0;
+
+do {
+    $line = Apache::TestRequest::getline($sock) || '';
+    $line = super_chomp($line);
+    print "# line: $line\n";
+    if ($line eq "Connection: close") {
+        $rv = 1;
+    }
+} until ($line eq "");
+
+ok $rv, 1, "expected Connection: close header in response";
+
+sub super_chomp {
+    my ($body) = shift;
+
+    ## super chomp - all leading and trailing \n (and \r for win32)
+    $body =~ s/^[\n\r]*//;
+    $body =~ s/[\n\r]*$//;
+    ## and all the rest change to spaces
+    $body =~ s/\n/ /g;
+    $body =~ s/\r//g; #rip out all remaining \r's
+
+    $body;
+}
diff --git a/debian/perl-framework/t/security/CVE-2011-3368-rewrite.t b/debian/perl-framework/t/security/CVE-2011-3368-rewrite.t
new file mode 100644
index 0000000..4107be0
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2011-3368-rewrite.t
@@ -0,0 +1,23 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+plan tests => 3, need 'rewrite';
+
+Apache::TestRequest::module("cve_2011_3368_rewrite");
+         
+my $sock = Apache::TestRequest::vhost_socket();
+ok $sock && $sock->connected;
+
+my $req = "GET @"."localhost/foobar.html HTTP/1.1\r\n".
+   "Host: " . Apache::TestRequest::hostport() . "\r\n".
+    "\r\n"; 
+
+ok $sock->print($req);
+
+my $line = Apache::TestRequest::getline($sock) || '';
+
+ok t_cmp($line, qr{^HTTP/1\.. 400 Bad Request}, "got 400 error");
diff --git a/debian/perl-framework/t/security/CVE-2011-3368.t b/debian/perl-framework/t/security/CVE-2011-3368.t
new file mode 100644
index 0000000..bbedc79
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2011-3368.t
@@ -0,0 +1,23 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+plan tests => 3, need 'proxy', need_min_apache_version('2.2.5');
+
+Apache::TestRequest::module("cve_2011_3368");
+         
+my $sock = Apache::TestRequest::vhost_socket();
+ok $sock && $sock->connected;
+
+my $req = "GET @"."localhost/foobar.html HTTP/1.1\r\n".
+   "Host: " . Apache::TestRequest::hostport() . "\r\n".
+    "\r\n"; 
+
+ok $sock->print($req);
+
+my $line = Apache::TestRequest::getline($sock) || '';
+
+ok t_cmp($line, qr{^HTTP/1\.. 400 Bad Request}, "got 400 error");
diff --git a/debian/perl-framework/t/security/CVE-2017-7659.t b/debian/perl-framework/t/security/CVE-2017-7659.t
new file mode 100644
index 0000000..690922d
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2017-7659.t
@@ -0,0 +1,28 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+plan tests => 2,
+     need(
+         need_module('http2')
+     );
+
+my $module = "h2c";
+Apache::TestRequest::module($module);
+
+my $sock = Apache::TestRequest::vhost_socket($module);
+ok $sock;
+
+# Thanks to Javier Jimenez for this test case.
+Apache::TestRequest::socket_trace($sock);
+$sock->print("p * HTTP/1.0\r\n"
+           . "Connection:H/\r\n"
+           . "Upgrade:h2c\r\n"
+           . "HTTP2-Settings:\r\n\r\n");
+
+# The server should not have crashed -- getc() should return *something*.
+ok $sock->getc();
+$sock->close();
diff --git a/debian/perl-framework/t/security/CVE-2019-0215.t b/debian/perl-framework/t/security/CVE-2019-0215.t
new file mode 100644
index 0000000..978c1ef
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2019-0215.t
@@ -0,0 +1,47 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my $vars = Apache::Test::vars();
+
+plan tests => 2, need $vars->{ssl_module_name}, need_lwp,
+    qw(LWP::Protocol::https);
+
+my $r;
+
+Apache::TestRequest::user_agent(ssl_opts => {SSL_version => 'TLSv13'});
+Apache::TestRequest::scheme('https');
+Apache::TestRequest::module('ssl_optional_cc');
+
+$r = GET "/require/none/";
+my $tls13_works = $r->is_success;
+
+# Forget the above user agent settings, start fresh
+Apache::TestRequest::user_agent(reset => 1);
+
+# If TLS 1.3 worked, run the tests using it and expect 403.
+# Older TLS versions seem to show the TLS alert client side as a 500.
+my $expected_status;
+if ($tls13_works) {
+  Apache::TestRequest::user_agent(ssl_opts => {SSL_version => 'TLSv13'});
+  $expected_status = 403;
+  t_debug "Using TLSv13, expecting status 403";
+} else {
+  t_debug "Using TLS before TLSv13, expecting status 500";
+  $expected_status = 500;
+}
+
+Apache::TestRequest::user_agent_keepalive(1);
+Apache::TestRequest::scheme('https');
+Apache::TestRequest::module('ssl_optional_cc');
+
+$r = GET "/require/any/";
+
+ok t_cmp($r->code, $expected_status, "first access denied without client cert");
+
+$r = GET "/require/any/";
+
+ok t_cmp($r->code, $expected_status, "second access denied without client cert");
diff --git a/debian/perl-framework/t/security/CVE-2020-1927.t b/debian/perl-framework/t/security/CVE-2020-1927.t
new file mode 100644
index 0000000..523feb6
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2020-1927.t
@@ -0,0 +1,60 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+use MIME::Base64;
+use Data::Dumper;
+use HTTP::Response;
+use Socket;
+
+plan tests => 1, need_min_apache_version('2.4.42');
+
+my $sock = Apache::TestRequest::vhost_socket("core");
+if (!$sock) {
+    print "# failed to connect\n";
+    ok(0);
+    next;
+}
+
+my $req = sprintf "GET /CVE-2020-1927/%%0D%%0Ahttp://127.0.0.1/ HTTP/1.1\r\nHost: merge-disabled\r\nConnection: close\r\n\r\n";
+print "# SENDING to " . peer($sock) . "\n# $req\n";
+$sock->print("$req");
+$sock->flush();
+sleep(0.1);
+$req = escape($req);
+print "# SENDING to " . peer($sock) . "\n# $req\n";
+
+my $response_data = "";
+my $buf;
+while ($sock->read($buf, 10000) > 0) {
+    $response_data .= $buf;
+}
+my $response = HTTP::Response->parse($response_data);
+if (! defined $response) {
+    die "HTTP::Response->parse failed";
+}
+ok t_cmp($response->code, 404,  "regex didn't match and redirect");
+
+sub escape
+{
+    my $in = shift;
+    $in =~ s{\\}{\\\\}g;
+    $in =~ s{\r}{\\r}g;
+    $in =~ s{\n}{\\n}g;
+    $in =~ s{\t}{\\t}g;
+    $in =~ s{([\x00-\x1f])}{sprintf("\\x%02x", ord($1))}ge;
+    return $in;
+}
+
+sub peer
+{
+   my $sock = shift;
+   my $hersockaddr    = getpeername($sock);
+   return "<disconnected>" if !$hersockaddr;
+   my ($port, $iaddr) = sockaddr_in($hersockaddr);
+   my $herhostname    = gethostbyaddr($iaddr, AF_INET);
+   my $herstraddr     = inet_ntoa($iaddr);
+   return "$herstraddr:$port";
+}