安全性: 修复了 CVE-2024-29272 中的多个文件名黑名单绕过问题

#!/usr/bin/env python3
# Simulated blacklist from the fix
BLOCKED_EXTENSIONS = ['.php', '.php3', '.php4', '.php5', '.phtml', '.exe', '.sh', '.bat']

def is_allowed_VULNERABLE(filename):
    """Vulnerable blacklist check"""
    lower = filename.lower()
    for ext in BLOCKED_EXTENSIONS:
        if lower.endswith(ext):
            return False
    return True
# Bypass test cases
bypass_tests = [
    # Double extension
    ("shell.php.jpg", "Double extension"),
    # Null byte (if backend is vulnerable)
    ("shell.php%00.jpg", "Null byte injection"),
    # Case manipulation
    ("shell.PHP", "Case bypass"),
    ("shell.pHp", "Mixed case"),
    # Alternative PHP extensions
    ("shell.phar", "PHAR archive"),
    ("shell.inc", "PHP include"),
    ("shell.php7", "PHP7 extension"),
    # Trailing characters (Windows)
    ("shell.php.", "Trailing dot"),
    ("shell.php ", "Trailing space"),
    ("shell.php::$DATA", "NTFS ADS"),
    # htaccess abuse
    (".htaccess", "htaccess override"),
    # Polyglot
    ("shell.php.png", "Polyglot"),
    # Other server-side languages
    ("shell.shtml", "SSI enabled"),
    ("shell.asp", "ASP (IIS)"),
    ("shell.aspx", "ASPX (IIS)"),
    ("shell.jsp", "JSP (Tomcat)"),
    ("shell.jspx", "JSPX (Tomcat)"),
    ("shell.cfm", "ColdFusion"),
]
print("=== Blacklist Bypass Test ===\n")
print(f"Blocked extensions: {BLOCKED_EXTENSIONS}\n")
bypassed = 0
blocked = 0
for filename, technique in bypass_tests:
    allowed = is_allowed_VULNERABLE(filename)
…