From 1f4e7fb4b738bcced182ef3c4821f54c77fac13c Mon Sep 17 00:00:00 2001
From: Eric Covener <ecovener@us.ibm.com>
Date: Mon, 4 May 2026 13:05:11 -0400
Subject: [PATCH] setenvif restricted dexpr

---
 t/modules/setenvif.t | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/t/modules/setenvif.t b/t/modules/setenvif.t
index cb561c28..0b13fb81 100644
--- a/t/modules/setenvif.t
+++ b/t/modules/setenvif.t
@@ -56,7 +56,7 @@ my @var = qw(VAR_ONE VAR_TWO VAR_THREE);
 
 my $htaccess = "$htdocs/modules/setenvif/htaccess/.htaccess";
 
-plan tests => @var * 10 + (keys %var_att) * 6 * @var + 4,
+plan tests => @var * 10 + (keys %var_att) * 6 * @var + 5,
     have_module qw(setenvif include);
 
 sub write_htaccess {
@@ -178,6 +178,16 @@ else {
     skip "skipping inverted match test with version <2.4.38"
 }
 
+if (need_min_apache_version("2.4.67")) {
+    # file() access should be disallowed in htaccess context
+    write_htaccess("SetEnvIfExpr \"file('$htdocs/foobar.html') =~ /(.+)/\" VAR_ONE=\$0");
+    $body = GET_BODY $page;
+    ok ! t_cmp($body, qr/^1:foobar/);
+}
+else {
+    skip "skipping test for CVE-2026-24072 in version <2.4.67";
+}
+
 ## i think this should work, but it doesnt.
 ## leaving it commented now pending investigation.
 ## seems you cant override variables that have been previously set.