summaryrefslogtreecommitdiff
path: root/test/integration/test-cve-2019-3462-dequote-injection
diff options
context:
space:
mode:
authorSam Bingner <sam@bingner.com>2019-04-10 21:21:22 -1000
committerSam Bingner <sam@bingner.com>2019-04-10 21:21:22 -1000
commitff4a8039b2e1a4ff53f1114266b9bec24b174f81 (patch)
treeaa6062812ea83865aee005e3e18d93d4360bb3d9 /test/integration/test-cve-2019-3462-dequote-injection
parent6ff13d9bd5b09dd85f853ba543bfe350b06d186f (diff)
parent2f984e7730b341879db3cfd330c8443e48e6efb0 (diff)
Merge tag '1.4.9'
apt Debian release 1.4.9
Diffstat (limited to 'test/integration/test-cve-2019-3462-dequote-injection')
-rwxr-xr-xtest/integration/test-cve-2019-3462-dequote-injection66
1 files changed, 66 insertions, 0 deletions
diff --git a/test/integration/test-cve-2019-3462-dequote-injection b/test/integration/test-cve-2019-3462-dequote-injection
new file mode 100755
index 000000000..a1adec6de
--- /dev/null
+++ b/test/integration/test-cve-2019-3462-dequote-injection
@@ -0,0 +1,66 @@
+#!/bin/sh
+set -e
+
+TESTDIR="$(readlink -f "$(dirname "$0")")"
+. "$TESTDIR/framework"
+setupenvironment
+configarchitecture 'amd64'
+
+# build two uncompressed packages
+buildsimplenativepackage 'alpha' 'all' '1' 'unstable' '' '' 'section' 'optional' '' 'none'
+
+setupaptarchive --no-update
+ORIGINAL_SHA256=$(sha256sum aptarchive/pool/alpha_1_all.deb | awk '{print $1}')
+ORIGINAL_SIZE=$(wc -c aptarchive/pool/alpha_1_all.deb | awk '{print $1}')
+SHA256="DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
+changetowebserver
+
+webserverconfig aptwebserver::redirect::replace::alpha_1_all.deb "beeta_1_all.deb%250a%250a201%2520URI%2520Done%250aURI:%2520http://localhost:${APTHTTPPORT}/pool/beeta_1_all.deb%250aFilename:%2520${TMPWORKINGDIRECTORY}/rootdir/var/cache/apt/archives/partial/alpha_1_all.deb%250aSize:%252020672%250aLast-Modified:%2520Fri,%252018%2520Jan%25202019%252009:52:02%2520+0000%250aSHA256-Hash:%2520${SHA256}%250aChecksum-FileSize-Hash:%252012345%250a%250a%0a"
+
+
+testsuccess apt update -o debug::http=1 -o debug::pkgacquire::worker=1
+
+
+testfailureequal "Reading package lists...
+Building dependency tree...
+The following NEW packages will be installed:
+ alpha
+0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
+Need to get 20.7 kB of archives.
+After this operation, 11.3 kB of additional disk space will be used.
+Err:1 http://localhost:${APTHTTPPORT} unstable/main all alpha all 1
+ SECURITY: URL redirect target contains control characters, rejecting.
+E: Failed to fetch http://localhost:${APTHTTPPORT}/pool/alpha_1_all.deb SECURITY: URL redirect target contains control characters, rejecting.
+E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?" aptget install alpha
+
+
+
+# For reference, the following is the original reproducer/bug. It has
+# been disabled using exit 0, as it will fail in fixed versions.
+exit 0
+
+testfailureequal "Reading package lists...
+Building dependency tree...
+The following NEW packages will be installed:
+ alpha
+0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
+Need to get 20.7 kB of archives.
+After this operation, 11.3 kB of additional disk space will be used.
+Err:1 http://localhost:${APTHTTPPORT} unstable/main all alpha all 1
+ Hash Sum mismatch
+ Hashes of expected file:
+ - SHA256:$ORIGINAL_SHA256
+ - Filesize:$ORIGINAL_SIZE [weak]
+ Hashes of received file:
+ - SHA256:DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
+ - Filesize:12345 [weak]
+ Last modification reported: Fri, 18 Jan 2019 09:52:02 +0000
+E: Failed to fetch http://localhost:${APTHTTPPORT}/pool/beeta_1_all.deb Hash Sum mismatch
+ Hashes of expected file:
+ - SHA256:$ORIGINAL_SHA256
+ - Filesize:$ORIGINAL_SIZE [weak]
+ Hashes of received file:
+ - SHA256:DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
+ - Filesize:12345 [weak]
+ Last modification reported: Fri, 18 Jan 2019 09:52:02 +0000
+E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?" aptget install alpha