def test_execute_on_windows(self):
if os.name != 'nt':
print "Not executing test_execute_on_windows because os.name != 'nt'"
return
codec = WindowsCodec()
instance = ESAPI.executor()
orig_executable = "C:\\Windows\System32\cmd.exe"
parent_dir = 'C:\\'
params = ['/C', 'dir']
result = instance.execute_system_command(orig_executable, params, parent_dir, codec=codec)
print "result:", result
executable = orig_executable + ";inject.exe"
self.assertRaises(ExecutorException, instance.execute_system_command, executable, params, parent_dir, codec=codec)
executable = orig_executable + "\\..\\cmd.exe"
self.assertRaises(ExecutorException, instance.execute_system_command, executable, params, parent_dir, codec=codec)
work_dir = "C:\\ridiculous"
self.assertRaises(ExecutorException, instance.execute_system_command, orig_executable, params, parent_dir, work_dir, codec=codec)
params.append("&dir")
result = instance.execute_system_command(orig_executable, params, parent_dir, codec=codec)
print "result:", result
params = params[:-1] + ['c:\\autoexec.bat']
result = instance.execute_system_command(orig_executable, params, parent_dir, codec=codec)
print "result:", result
params = params[:-1] + ['c:\\autoexec.bat c:\\config.sys']
result = instance.execute_system_command(orig_executable, params, parent_dir, codec=codec)
print "result:", result
def test_execute_on_linux(self):
if os.name == 'nt':
print "Not executing test_execute_on_linux because os.name == 'nt'"
return
codec = UnixCodec()
instance = ESAPI.executor()
executable = "/bin/sh"
params = ['-c', 'ls', '/']
parent_dir = '/'
result = instance.execute_system_command(executable, params, parent_dir, codec=codec)
print "result:", result
# Don't log the params
result = instance.execute_system_command(executable, params, parent_dir, log_params=False)
# Test default codec
result = instance.execute_system_command(executable, params, parent_dir)
print "result:", result
# Test bad executable
self.assertRaises( ExecutorException, instance.execute_system_command, "/usr/bin/passwd", [], parent_dir)
# Test bad working directory
self.assertRaises( ExecutorException, instance.execute_system_command, executable, params, parent_dir, "/rediculous")
executable = '/bin/sh;.inject'
self.assertRaises( ExecutorException, instance.execute_system_command, executable, params, parent_dir, codec=codec)
executable = '/../bin/sh'
self.assertRaises( ExecutorException, instance.execute_system_command, executable, params, parent_dir, codec=codec)
executable = '/bin/sh'
params.append(';ls')
result = instance.execute_system_command(executable, params, parent_dir, codec=codec)
print "result:", result
# Exceed the runtime
executable = '/bin/sleep'
params = ['30']
self.assertRaises( ExecutorException, instance.execute_system_command, executable, params, parent_dir)
