Function TestSplitPosUnicodeSecurityRegression

cgi_test.go:251–271

TestSplitPosUnicodeSecurityRegression specifically tests the vulnerability described in GHSA-g966-83w7-6w38 where Unicode case-folding caused incorrect SCRIPT_NAME/PATH_INFO splitting

(t *testing.T)

// described in GHSA-g966-83w7-6w38 where Unicode case-folding caused
// incorrect SCRIPT_NAME/PATH_INFO splitting
func TestSplitPosUnicodeSecurityRegression(t *testing.T) {
	// U+023A: Ⱥ (UTF-8: C8 BA). Lowercase is ⱥ (UTF-8: E2 B1 A5), longer in bytes.
	path := "/ȺȺȺȺshell.php.txt.php"
	split := []string{".php"}

	pos := splitPos(path, split)

	// The vulnerable code would return 22 (computed on lowercased string)
	// The correct code should return 18 (position in original string)
	expectedPos := strings.Index(path, ".php") + len(".php")
	assert.Equal(t, expectedPos, pos, "split position should match first .php in original string")
	assert.Equal(t, 18, pos, "split position should be 18, not 22")

	if pos > 0 && pos <= len(path) {
		scriptName := path[:pos]
		pathInfo := path[pos:]

		assert.Equal(t, "/ȺȺȺȺshell.php", scriptName, "script name should be the path up to first .php")
		assert.Equal(t, ".txt.php", pathInfo, "path info should be the remainder after first .php")
	}
}

// TestSplitPosSecurityRegressionUnicodeBypass guards against
// GHSA-3g8v-8r37-cgjm (uninitialized match flag on inner non-ASCII byte) and