SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit

[lhc/web/wiklou.git] / tests / phpunit / languages / LanguageConverterTest.php

diff --git a/tests/phpunit/languages/LanguageConverterTest.php b/tests/phpunit/languages/LanguageConverterTest.php
index d4ccca9..331368e 100644 (file)
--- a/tests/phpunit/languages/LanguageConverterTest.php
+++ b/tests/phpunit/languages/LanguageConverterTest.php
@@ -9,19 +9,18 @@ class LanguageConverterTest extends MediaWikiLangTestCase {
        protected function setUp() {
                parent::setUp();
 
-               $this->setMwGlobals( array(
+               $this->setMwGlobals( [
                        'wgContLang' => Language::factory( 'tg' ),
                        'wgLanguageCode' => 'tg',
                        'wgDefaultLanguageVariant' => false,
-                       'wgMemc' => new EmptyBagOStuff,
-                       'wgRequest' => new FauxRequest( array() ),
+                       'wgRequest' => new FauxRequest( [] ),
                        'wgUser' => new User,
-               ) );
+               ] );
 
                $this->lang = new LanguageToTest();
                $this->lc = new TestConverter(
                        $this->lang, 'tg',
-                       array( 'tg', 'tg-latn' )
+                       [ 'tg', 'tg-latn' ]
                );
        }
 
@@ -158,30 +157,49 @@ class LanguageConverterTest extends MediaWikiLangTestCase {
                $wgRequest->setVal( 'variant', null );
                $this->assertEquals( 'tg', $this->lc->getPreferredVariant() );
        }
+
+       /**
+        * Test exhausting pcre.backtrack_limit
+        */
+       public function testAutoConvertT124404() {
+               $testString = '';
+               for ( $i = 0; $i < 1000; $i++ ) {
+                       $testString .= 'xxx xxx xxx';
+               }
+               $testString .= "\n<big id='в'></big>";
+               $old = ini_set('pcre.backtrack_limit', 200 );
+               $result = $this->lc->autoConvert( $testString, 'tg-latn' );
+               ini_set( 'pcre.backtrack_limit', $old );
+               // The в in the id attribute should not get converted to a v
+               $this->assertFalse(
+                       strpos( $result, 'v' ),
+                       "в converted to v despite being in attribue"
+               );
+       }
 }
 
 /**
  * Test converter (from Tajiki to latin orthography)
  */
 class TestConverter extends LanguageConverter {
-       private $table = array(
+       private $table = [
                'б' => 'b',
                'в' => 'v',
                'г' => 'g',
-       );
+       ];
 
        function loadDefaultTables() {
-               $this->mTables = array(
+               $this->mTables = [
                        'tg-latn' => new ReplacementArray( $this->table ),
                        'tg' => new ReplacementArray()
-               );
+               ];
        }
 }
 
 class LanguageToTest extends Language {
        function __construct() {
                parent::__construct();
-               $variants = array( 'tg', 'tg-latn' );
+               $variants = [ 'tg', 'tg-latn' ];
                $this->mConverter = new TestConverter( $this, 'tg', $variants );
        }
 }