diff options
| author | Unknwon <u@gogs.io> | 2018-12-25 09:45:20 -0500 |
|---|---|---|
| committer | Unknwon <u@gogs.io> | 2018-12-25 09:47:33 -0500 |
| commit | 5f1f1bb5ed3c9916f11016942b9f553ef4fb72a9 (patch) | |
| tree | 626d65ac7a5e9f10a3c36ed1650a1457af5cc42c /pkg/tool/path_test.go | |
| parent | 9ff2df78f02fb09106b33beb7e4c644f86c30c6f (diff) | |
pkg/tool/path: use IsMaliciousPath to replace SanitizePath (#5558)
Diffstat (limited to 'pkg/tool/path_test.go')
| -rw-r--r-- | pkg/tool/path_test.go | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/pkg/tool/path_test.go b/pkg/tool/path_test.go index d9b9fb21..44ee975f 100644 --- a/pkg/tool/path_test.go +++ b/pkg/tool/path_test.go @@ -31,22 +31,23 @@ func Test_IsSameSiteURLPath(t *testing.T) { }) } -func Test_SanitizePath(t *testing.T) { - Convey("Sanitize malicious user-defined path", t, func() { +func Test_IsMaliciousPath(t *testing.T) { + Convey("Detects malicious path", t, func() { testCases := []struct { path string - expect string + expect bool }{ - {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, - {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, - - {"data/sessions/a/9/a9f0ab6c3ef63dd8", "data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, + {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"..\\/..\\/../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true}, + {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true}, + + {"data/sessions/a/9/a9f0ab6c3ef63dd8", false}, + {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", false}, } for _, tc := range testCases { - So(SanitizePath(tc.path), ShouldEqual, tc.expect) + So(IsMaliciousPath(tc.path), ShouldEqual, tc.expect) } }) } |