Skip to content

Commit de51612

Browse files
committed
Fix bug71610.phpt
Apparently example.org now rejects POST requests, so we would need to adjust the test expectation ("Method not allowed"). However, there is no need for an online test; instead we're just using the CLI test server. The serialization is a bit fiddly, but as long as there are no quotes in `PHP_CLI_SERVER_ADDRESS` we're fine. Closes GH-16063.
1 parent f4c45ee commit de51612

File tree

1 file changed

+11
-2
lines changed

1 file changed

+11
-2
lines changed

ext/soap/tests/bug71610.phpt

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,20 @@ SOAP Bug #71610 - Type Confusion Vulnerability - SOAP / make_http_soap_request()
44
soap
55
--SKIPIF--
66
<?php
7-
if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
7+
if (!file_exists(__DIR__ . "/../../../sapi/cli/tests/php_cli_server.inc")) {
8+
echo "skip sapi/cli/tests/php_cli_server.inc required but not found";
9+
}
810
?>
911
--FILE--
1012
<?php
11-
$exploit = unserialize('O:10:"SoapClient":3:{s:3:"uri";s:1:"a";s:8:"location";s:19:"http://example.org/";s:8:"_cookies";a:1:{s:8:"manhluat";a:3:{i:0;s:0:"";i:1;N;i:2;N;}}}');
13+
include __DIR__ . "/../../../sapi/cli/tests/php_cli_server.inc";
14+
php_cli_server_start();
15+
16+
$url = "http://" . PHP_CLI_SERVER_ADDRESS;
17+
$ser = 'O:10:"SoapClient":3:{s:3:"uri";s:1:"a";s:8:"location";s:' . strlen($url) . ':"'
18+
. $url . '";s:8:"_cookies";a:1:{s:8:"manhluat";a:3:{i:0;s:0:"";i:1;N;i:2;N;}}}';
19+
20+
$exploit = unserialize($ser);
1221
try {
1322
$exploit->blahblah();
1423
} catch(SoapFault $e) {

0 commit comments

Comments
 (0)