Function TestSplitPosSecurityRegressionUnicodeBypass

cgi_test.go:278–298

TestSplitPosSecurityRegressionUnicodeBypass guards against GHSA-3g8v-8r37-cgjm (uninitialized match flag on inner non-ASCII byte) and GHSA-v4h7-cj44-8fc8 (Unicode equivalence via search.IgnoreCase letting non-PHP files be picked up as the script). Every payload below produced a false positive in the

(t *testing.T)

// non-PHP files be picked up as the script). Every payload below produced a
// false positive in the vulnerable implementation; none must match here.
func TestSplitPosSecurityRegressionUnicodeBypass(t *testing.T) {
	t.Parallel()

	split := []string{".php"}
	payloads := []string{
		"/PoC-match-unset.¡.txt",                // GHSA-3g8v: match left set after IndexString fallback returned -1
		"/shell﹒php",                            // U+FE52 small full stop
		"/shell．php",                            // U+FF0E fullwidth full stop
		"/shell.ｐhp",                            // U+FF50 fullwidth p
		"/shell.pｈp",                            // U+FF48 fullwidth h
		"/shell.phｐ",                            // U+FF50 fullwidth p (trailing)
		"/shell.\U0001D5C1\U0001D5B5\U0001D5C1", // mathematical sans-serif p/h
		"/shell.\U0001D5FD\U0001D5F5\U0001D5FD", // mathematical sans-serif bold p/h
		"/shell.\U0001D4C5\U0001D4BD\U0001D4C5", // mathematical script p/h
		"/shell.ⓟⓗⓟ",                            // circled latin small
	}

	for _, p := range payloads {
		assert.Equalf(t, -1, splitPos(p, split), "payload %q must not be detected as .php", p)
	}
}