view release on metacpan or  search on metacpan

t/cgi_security.t  view on Meta::CPAN

subtest 'ATTACK: PTR record with shell metacharacters (command injection via hostname)' => sub {
	# Exploit: if _is_cloud_host() or any downstream caller ever passed the
	# hostname to system() or 2-arg open(), a PTR like
	# "ec2.amazonaws.com; id" would execute arbitrary commands.
	# CGI::ACL only performs a regex match; the hostname is never shelled.
	my $shell_host = 'ec2-1-2-3-4.compute-1.amazonaws.com; cat /etc/passwd';
	my $inject_guard = mock_scoped 'CGI::ACL::_verified_rdns' => sub { $shell_host };
	my $acl    = CGI::ACL->new()->deny_cloud();
	my $result = eval { denied_at($acl, $CLOUD_IP) };
	ok(!$@, 'shell-metachar PTR hostname does not cause an exception');
	pass('no command was executed; test process alive after shell payload in PTR');
};

subtest 'ATTACK: PTR record with CRLF sequence (header-splitting via DNS)' => sub {
	# Exploit: \r\n in a PTR record could split HTTP headers if the hostname
	# were ever emitted in a response.  CGI::ACL does not output the hostname.
	# We verify no exception is raised.
	my $crlf_host  = "ec2.compute-1.amazonaws.com\r\nX-Injected: pwned";
	my $crlf_guard = mock_scoped 'CGI::ACL::_verified_rdns' => sub { $crlf_host };
	my $acl    = CGI::ACL->new()->deny_cloud();
	my $result = eval { denied_at($acl, $CLOUD_IP) };