From 3ee0710d1d47bec895568563aeca2d3b53bfa8ce Mon Sep 17 00:00:00 2001 From: Nick Thomas Date: Tue, 11 Dec 2018 16:52:22 +0000 Subject: Validate LFS hrefs before downloading them --- .../projects/lfs_pointers/lfs_download_service_spec.rb | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'spec/services/projects/lfs_pointers') diff --git a/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb b/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb index 6af5bfc7689..d7d7f1874eb 100644 --- a/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb +++ b/spec/services/projects/lfs_pointers/lfs_download_service_spec.rb @@ -54,6 +54,18 @@ describe Projects::LfsPointers::LfsDownloadService do end end + context 'when a bad URL is used' do + where(download_link: ['/etc/passwd', 'ftp://example.com', 'http://127.0.0.2']) + + with_them do + it 'does not download the file' do + expect(subject).not_to receive(:download_and_save_file) + + expect { subject.execute(oid, download_link) }.not_to change { LfsObject.count } + end + end + end + context 'when an lfs object with the same oid already exists' do before do create(:lfs_object, oid: 'oid') -- cgit v1.2.1