From 5f1f1bb5ed3c9916f11016942b9f553ef4fb72a9 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Tue, 25 Dec 2018 09:45:20 -0500 Subject: pkg/tool/path: use IsMaliciousPath to replace SanitizePath (#5558) --- pkg/tool/path_test.go | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) (limited to 'pkg/tool/path_test.go') diff --git a/pkg/tool/path_test.go b/pkg/tool/path_test.go index d9b9fb21..44ee975f 100644 --- a/pkg/tool/path_test.go +++ b/pkg/tool/path_test.go @@ -31,22 +31,23 @@ func Test_IsSameSiteURLPath(t *testing.T) { }) } -func Test_SanitizePath(t *testing.T) { - Convey("Sanitize malicious user-defined path", t, func() { +func Test_IsMaliciousPath(t *testing.T) { + Convey("Detects malicious path", t, func() { testCases := []struct { path string - expect string + expect bool }{ - {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, - {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, - - {"data/sessions/a/9/a9f0ab6c3ef63dd8", "data/sessions/a/9/a9f0ab6c3ef63dd8"}, - {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", "data\\sessions\\a\\9\\a9f0ab6c3ef63dd8"}, + {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"..\\/..\\/../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", true}, + {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true}, + {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true}, + + {"data/sessions/a/9/a9f0ab6c3ef63dd8", false}, + {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", false}, } for _, tc := range testCases { - So(SanitizePath(tc.path), ShouldEqual, tc.expect) + So(IsMaliciousPath(tc.path), ShouldEqual, tc.expect) } }) } -- cgit v1.2.3