Merge ~federicoquattrin/qa-regression-testing:add_libspreadsheet-parseexcel-perl_tests into qa-regression-testing:master

[Federico Quattrin]

added tests for libspreadsheet-parseexcel-perl

added tests for libspreadsheet-parseexcel-perl

bf54b5f... by Federico Quattrin on 2024-05-21

added additional files for libspreadsheet-parseexcel-perl

[Marc Deslauriers (mdeslaur)]

Where did the binary files come from, and how are they licensed?

Unmerged commits

bf54b5f... by Federico Quattrin on 2024-05-21

added additional files for libspreadsheet-parseexcel-perl

	imagemagick:0 (build)
	imagemagick:1 (build)
	imagemagick:2 (build)
	gcc-security:0 (build)
	gcc-security:1 (build)
	gcc-security:2 (build)
	glibc:0 (build)
	glibc:1 (build)
	glibc:2 (build)
	glibc-security:0 (build)
	glibc-security:1 (build)
	glibc-security:2 (build)
	gnupg:0 (build)
	gnupg:1 (build)
	gnupg:2 (build)
	sudo:0 (build)
	sudo:1 (build)
	sudo:2 (build)
	git:0 (build)
	git:1 (build)
	git:2 (build)
	ghostscript:0 (build)
	ghostscript:1 (build)
	ghostscript:2 (build)
	busybox:0 (build)
	busybox:1 (build)
	busybox:2 (build)
	coreutils:0 (build)
	coreutils:1 (build)
	coreutils:2 (build)
	util-linux:0 (build)
	util-linux:1 (build)
	util-linux:2 (build)
	ecdsautils:0 (build)
	ecdsautils:1 (build)
	ecdsautils:2 (build)
	python-urllib3:0 (build)
	python-urllib3:1 (build)
	python-urllib3:2 (build)
	amanda:0 (build)
	amanda:1 (build)
	cryptojs:0 (build)
	cryptojs:1 (build)
	cryptojs:2 (build)
	cryptojs:3 (build)

1 → 45 of 45 results

First • Previous • Next • Last

5450203... by Federico Quattrin on 2024-05-21

added tests for libspreadsheet-parseexcel-perl

	imagemagick:0 (build)
	imagemagick:1 (build)
	imagemagick:2 (build)
	gcc-security:0 (build)
	gcc-security:1 (build)
	gcc-security:2 (build)
	glibc:0 (build)
	glibc:1 (build)
	glibc:2 (build)
	glibc-security:0 (build)
	glibc-security:1 (build)
	glibc-security:2 (build)
	gnupg:0 (build)
	gnupg:1 (build)
	gnupg:2 (build)
	sudo:0 (build)
	sudo:1 (build)
	sudo:2 (build)
	git:0 (build)
	git:1 (build)
	git:2 (build)
	ghostscript:0 (build)
	ghostscript:1 (build)
	ghostscript:2 (build)
	busybox:0 (build)
	busybox:1 (build)
	busybox:2 (build)
	coreutils:0 (build)
	coreutils:1 (build)
	coreutils:2 (build)
	util-linux:0 (build)
	util-linux:1 (build)
	util-linux:2 (build)
	ecdsautils:0 (build)
	ecdsautils:1 (build)
	ecdsautils:2 (build)
	python-urllib3:0 (build)
	python-urllib3:1 (build)
	python-urllib3:2 (build)
	amanda:0 (build)
	amanda:1 (build)
	cryptojs:0 (build)
	cryptojs:1 (build)
	cryptojs:2 (build)
	cryptojs:3 (build)

1 → 45 of 45 results

First • Previous • Next • Last

diff --git a/scripts/spreadsheet-parseexcel/exploit.pl b/scripts/spreadsheet-parseexcel/exploit.pl
new file mode 100644
index 0000000..b9ef0de
--- /dev/null
+++ b/scripts/spreadsheet-parseexcel/exploit.pl
@@ -0,0 +1,6 @@
+use strict;
+use Spreadsheet::ParseExcel;
+
+my $parser = Spreadsheet::ParseExcel->new();
+# file.xls is malicious file from end user
+my $workbook = $parser->parse("test.xls");
\ No newline at end of file
diff --git a/scripts/spreadsheet-parseexcel/test.xls b/scripts/spreadsheet-parseexcel/test.xls
new file mode 100644
index 0000000..6e89acc
Binary files /dev/null and b/scripts/spreadsheet-parseexcel/test.xls differ
diff --git a/scripts/spreadsheet-parseexcel/test.xlsx b/scripts/spreadsheet-parseexcel/test.xlsx
new file mode 100644
index 0000000..c9190fc
Binary files /dev/null and b/scripts/spreadsheet-parseexcel/test.xlsx differ
diff --git a/scripts/test-libspreadsheet-parseexcel-perl.py b/scripts/test-libspreadsheet-parseexcel-perl.py
new file mode 100755
index 0000000..0a8c03d
--- /dev/null
+++ b/scripts/test-libspreadsheet-parseexcel-perl.py
@@ -0,0 +1,83 @@
+#!/usr/bin/python3
+#
+#    test-spreadsheet-parseexcel.py quality assurance test script for PKG
+#    Copyright (C) 2012 Canonical Ltd.
+#    Author:
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License version 3,
+#    as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+# QRT-Packages: libspreadsheet-parseexcel-perl
+# QRT-Depends: spreadsheet-parseexcel
+
+'''
+    In general, this test should be run in a virtual machine (VM) or possibly
+    a chroot and not on a production machine. While efforts are made to make
+    these tests non-destructive, there is no guarantee this script will not
+    alter the machine. You have been warned.
+
+    How to run in a clean VM:
+    $ ./make-test-tarball test-spreadsheet-parseexcel.py     # creates tarball in /tmp/
+    $ scp /tmp/qrt-test-spreadsheet-parseexcel.tar.gz [e-mail]:/tmp
+    on VM:
+    # cd /tmp ; tar zxvf ./qrt-test-spreadsheet-parseexcel.tar.gz
+    # cd /tmp/qrt-test-spreadsheet-parseexcel ; ./install-packages ./test-spreadsheet-parseexcel.py
+    # ./test-spreadsheet-parseexcel.py -v
+
+    To run in all VMs named sec*:
+    $ vm-qrt -p sec test-<script.py>
+
+    ### TODO: update for ./install-packages step ###
+    How to run in a clean schroot named 'lucid':
+    $ schroot -c lucid -u root -- sh -c 'apt-get -y install lsb-release <QRT-Packages> && ./test-PKG.py -v'
+'''
+
+from __future__ import print_function
+
+import os
+import subprocess
+import sys
+import unittest
+import testlib
+
+
+class SpreadsheetParseExcelTest(testlib.TestlibCase):
+    '''Test the perl library Spreadsheet::ParseExcel.'''
+
+    def tearDown(self):
+        '''Clean up after each test_* function'''
+        if os.path.exists("/tmp/inject.txt"):
+            os.remove("/tmp/inject.txt")
+
+    def test_cve_2023_7101(self):
+        '''Test CVE-2023-7101'''
+        os.chdir("{}/spreadsheet-parseexcel".format(os.path.dirname(os.path.realpath(__file__))))
+        self.exploit()
+        injected_exists = os.path.exists("/tmp/inject.txt")
+        if injected_exists:
+            with open("/tmp/inject.txt", "r") as injected_file:
+                file_content = injected_file.read()
+            print("Injected file exists and it's content is {}".format(file_content))
+        self.assertFalse(injected_exists)
+    
+    def exploit(self):
+        if self.lsb_release.get("Release") == 14.04:
+            subprocess.call(["perl", "exploit.pl"])
+        else:
+            subprocess.run(["perl", "exploit.pl"])
+
+
+
+
+if __name__ == '__main__':
+    unittest.main()