diff options
Diffstat (limited to 'pkg/tool/path_test.go')
| -rw-r--r-- | pkg/tool/path_test.go | 23 |
1 files changed, 12 insertions, 11 deletions
diff --git a/pkg/tool/path_test.go b/pkg/tool/path_test.go index d9b9fb21..44ee975f 100644 --- a/pkg/tool/path_test.go +++ b/pkg/tool/path_test.go @@ -31,22 +31,23 @@ func Test_IsSameSiteURLPath(t *testing.T) { }) } -func Test_SanitizePath(t *testing.T) { - Convey("Sanitize malicious user-defined path", t, func() { +func Test_IsMaliciousPath(t *testing.T) { + Convey("Detects malicious path", t, func() { testCases := []struct { path string - expect string + expect bool }{ - {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, - {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, - - {"data/sessions/a/9/a9f0ab6c3ef63dd8", "data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, + {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"..\\/..\\/../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true}, + {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true}, + + {"data/sessions/a/9/a9f0ab6c3ef63dd8", false}, + {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", false}, } for _, tc := range testCases { - So(SanitizePath(tc.path), ShouldEqual, tc.expect) + So(IsMaliciousPath(tc.path), ShouldEqual, tc.expect) } }) } |