Test that incoming paths cannot contain /../

2008-03-19 21:28:46 +02:00 · 2008-03-19 21:28:46 +02:00 · f7bcd554fa
parent e1d150daf5
commit f7bcd554fa
1 changed files with 12 additions and 0 deletions
--- a/gitosis/test/test_serve.py
+++ b/gitosis/test/test_serve.py
@ -57,6 +57,18 @@ def test_bad_unsafeArguments():
    eq(str(e), 'Arguments to command look dangerous')
    assert isinstance(e, serve.ServingError)

+def test_bad_unsafeArguments_dotdot():
+    cfg = RawConfigParser()
+    e = assert_raises(
+        serve.UnsafeArgumentsError,
+        serve.serve,
+        cfg=cfg,
+        user='jdoe',
+        command='git-upload-pack something/../evil',
+        )
+    eq(str(e), 'Arguments to command look dangerous')
+    assert isinstance(e, serve.ServingError)
+
 def test_bad_forbiddenCommand_read():
    cfg = RawConfigParser()
    e = assert_raises(