File tree Expand file tree Collapse file tree 2 files changed +6
-17
lines changed Expand file tree Collapse file tree 2 files changed +6
-17
lines changed Original file line number Diff line number Diff line change 3
3
namespace unit \zip ;
4
4
5
5
use PHPUnitTestCase ;
6
- use Symfony \Component \Filesystem \Filesystem ;
7
6
use Symfony \Component \Filesystem \Path ;
8
- use ZipArchive ;
9
7
use function WordPress \Zip \zip_extract_to ;
10
8
11
9
class ZipFunctionsTest extends PHPUnitTestCase {
12
10
public function testIsImmuneToZipSlipVulnerability () {
13
- $ filesystem = new Filesystem ();
11
+ // zipped file named: "../../../../../../../../tmp/zip-slip-test.txt"
12
+ $ zip = __DIR__ . '/resources/zip-slip-test.zip ' ;
14
13
15
- $ filename = __DIR__ . 'tmp/zip-slip-test.zip ' ;
16
- $ filesystem ->mkdir ( dirname ( $ filename ) );
14
+ zip_extract_to ( fopen ( $ zip , 'rb ' ), dirname ( $ zip ) );
17
15
18
- $ zip = new ZipArchive ();
19
- $ zip ->open ( $ filename , ZipArchive::CREATE );
20
- $ zip ->addFromString ( "../../../../../../../../tmp/zip-slip-test.txt " . time (), "zip slip test " );
21
- $ zip ->close ();
22
-
23
- zip_extract_to ( fopen ( $ filename , 'rb ' ), dirname ( $ filename ) );
24
-
25
- $ slipped_dir = Path::canonicalize (__DIR__ . "../../../../../../../../tmp " );
26
- self ::assertDirectoryDoesNotExist ( $ slipped_dir );
27
-
28
- $ filesystem ->remove ( dirname ( $ filename ) );
16
+ $ slipped_file = Path::canonicalize (__DIR__ . "../../../../../../../../tmp/zip-slip-test.txt " );
17
+ self ::assertFileDoesNotExist ( $ slipped_file );
29
18
}
30
- }
19
+ }
You can’t perform that action at this time.
0 commit comments