diff options
author | Jacob Vosmaer <jacob@gitlab.com> | 2016-08-10 17:40:20 +0200 |
---|---|---|
committer | Jacob Vosmaer <jacob@gitlab.com> | 2016-08-10 17:40:20 +0200 |
commit | 26b98bfff8c5bb7048bcbec46e028e30c46bccc5 (patch) | |
tree | 59efd9360829381150e96d5e7230b61e107777fc /spec | |
parent | f817eecb22517ece0344977d00ecc7ddfff30594 (diff) | |
download | gitlab-ce-26b98bfff8c5bb7048bcbec46e028e30c46bccc5.tar.gz |
Improve validation of X-Gitlab-Lfs-Tmp header
Diffstat (limited to 'spec')
-rw-r--r-- | spec/requests/lfs_http_spec.rb | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/spec/requests/lfs_http_spec.rb b/spec/requests/lfs_http_spec.rb index 26572699bf8..9db282a9f3d 100644 --- a/spec/requests/lfs_http_spec.rb +++ b/spec/requests/lfs_http_spec.rb @@ -556,7 +556,7 @@ describe 'Git LFS API and storage' do context 'and request is sent with a malformed headers' do before do - put_finalize('cat /etc/passwd') + put_finalize('/etc/passwd') end it 'does not recognize it as a valid lfs command' do @@ -588,7 +588,7 @@ describe 'Git LFS API and storage' do context 'and request is sent with a malformed headers' do before do - put_finalize('cat /etc/passwd') + put_finalize('/etc/passwd') end it 'does not recognize it as a valid lfs command' do @@ -636,6 +636,18 @@ describe 'Git LFS API and storage' do it 'lfs object is linked to the project' do expect(lfs_object.projects.pluck(:id)).to include(project.id) end + en + + context 'invalid tempfiles' do + it 'rejects slashes in the tempfile name (path traversal' do + put_finalize('foo/bar') + expect(response).to have_http_status(403) + end + + it 'rejects tempfile names that do not start with the oid' do + put_finalize("foo#{sample_oid}") + expect(response).to have_http_status(403) + end end end |