mirror of
https://github.com/php/php-src.git
synced 2026-04-20 06:21:12 +02:00
24 lines
649 B
PHP
24 lines
649 B
PHP
--TEST--
|
|
Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
|
|
--SKIPIF--
|
|
<?php
|
|
if (!extension_loaded("imap")) {
|
|
die("skip imap extension not available");
|
|
}
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
|
|
$payloadb64 = base64_encode($payload);
|
|
$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
|
|
@imap_open('{'.$server.':143/imap}INBOX', '', '');
|
|
// clean
|
|
imap_errors();
|
|
var_dump(file_exists(__DIR__ . '/__bug'));
|
|
?>
|
|
--EXPECT--
|
|
bool(false)
|
|
--CLEAN--
|
|
<?php
|
|
if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
|
|
?>
|