diff options
author | Cindy Pallares <cindy@gitlab.com> | 2018-12-06 18:38:43 +0000 |
---|---|---|
committer | Cindy Pallares <cindy@gitlab.com> | 2018-12-06 18:38:43 +0000 |
commit | a50c777d958d6e0f5c4cfc02294a40da088ceabd (patch) | |
tree | d3e5dc9ea02671ffa86f997175c17a05741ae952 /spec/lib/gitlab/utils_spec.rb | |
parent | daca42ac648166ea90ad6eb87e912c0b8c852933 (diff) | |
parent | 69645389e925a106f00fed555fde54c38f26816a (diff) | |
download | gitlab-ce-a50c777d958d6e0f5c4cfc02294a40da088ceabd.tar.gz |
Merge branch '54857-fix-templates-path-traversal' into 'master'
[master]: Prevent a path traversal attack on global file templates
Closes #2745
See merge request gitlab/gitlabhq!2677
Diffstat (limited to 'spec/lib/gitlab/utils_spec.rb')
-rw-r--r-- | spec/lib/gitlab/utils_spec.rb | 28 |
1 files changed, 27 insertions, 1 deletions
diff --git a/spec/lib/gitlab/utils_spec.rb b/spec/lib/gitlab/utils_spec.rb index 3579ed9a759..47a5fd0bdb4 100644 --- a/spec/lib/gitlab/utils_spec.rb +++ b/spec/lib/gitlab/utils_spec.rb @@ -2,7 +2,33 @@ require 'spec_helper' describe Gitlab::Utils do delegate :to_boolean, :boolean_to_yes_no, :slugify, :random_string, :which, :ensure_array_from_string, - :bytes_to_megabytes, :append_path, to: :described_class + :bytes_to_megabytes, :append_path, :check_path_traversal!, to: :described_class + + describe '.check_path_traversal!' do + it 'detects path traversal at the start of the string' do + expect { check_path_traversal!('../foo') }.to raise_error(/Invalid path/) + end + + it 'detects path traversal at the start of the string, even to just the subdirectory' do + expect { check_path_traversal!('../') }.to raise_error(/Invalid path/) + end + + it 'detects path traversal in the middle of the string' do + expect { check_path_traversal!('foo/../../bar') }.to raise_error(/Invalid path/) + end + + it 'detects path traversal at the end of the string when slash-terminates' do + expect { check_path_traversal!('foo/../') }.to raise_error(/Invalid path/) + end + + it 'detects path traversal at the end of the string' do + expect { check_path_traversal!('foo/..') }.to raise_error(/Invalid path/) + end + + it 'does nothing for a safe string' do + expect(check_path_traversal!('./foo')).to eq('./foo') + end + end describe '.slugify' do { |