mirror/php-monolog
1
0
Fork 0
mirror of https://github.com/Seldaek/monolog.git synced 2025-08-07 21:56:31 +02:00
Code Issues Releases Wiki Activity

Avoid information leaks through call_user_func arguments, fixes #1138

Browse Source
This commit is contained in:
Jordi Boggiano
2018-06-18 17:21:54 +02:00
parent 57a8a172e5
commit 3e92b08956
2 changed files with 43 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
tests/Monolog/Formatter/NormalizerFormatterTest.php
View File

@@ -407,6 +407,29 @@ class NormalizerFormatterTest extends \PHPUnit_Framework_TestCase
$result['context']['exception']['trace'][0]
);
}
public function testExceptionTraceDoesNotLeakCallUserFuncArgs()
{
try {
$arg = new TestInfoLeak;
call_user_func(array($this, 'throwHelper'), $arg, $dt = new \DateTime());
} catch (\Exception $e) {
}
$formatter = new NormalizerFormatter();
$record = array('context' => array('exception' => $e));
$result = $formatter->format($record);
$this->assertSame(
'{"function":"throwHelper","class":"Monolog\\\\Formatter\\\\NormalizerFormatterTest","type":"->","args":["[object] (Monolog\\\\Formatter\\\\TestInfoLeak)","'.$dt->format('Y-m-d H:i:s').'"]}',
$result['context']['exception']['trace'][0]
);
}
private function throwHelper($arg)
{
throw new \RuntimeException('Thrown');
}
}
class TestFooNorm
@@ -448,3 +471,11 @@ class TestToStringError
throw new \RuntimeException('Could not convert to string');
}
}
class TestInfoLeak
{
public function __toString()
{
return 'Sensitive information';
}
}