aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTommi Virtanen <tv@eagain.net>2008-03-19 21:28:46 +0200
committerTommi Virtanen <tv@eagain.net>2008-03-19 21:28:46 +0200
commitf7bcd554fae642585af5f99c3c858eb2d343e1da (patch)
treed6c9195fa70b8376b2c5cb2cc491f7a69d325660
parentShow alternate gitweb.conf access control config. (diff)
downloadgitosis-gentoo-f7bcd554fae642585af5f99c3c858eb2d343e1da.tar.gz
gitosis-gentoo-f7bcd554fae642585af5f99c3c858eb2d343e1da.tar.bz2
gitosis-gentoo-f7bcd554fae642585af5f99c3c858eb2d343e1da.zip
Test that incoming paths cannot contain /../
-rw-r--r--gitosis/test/test_serve.py12
1 files changed, 12 insertions, 0 deletions
diff --git a/gitosis/test/test_serve.py b/gitosis/test/test_serve.py
index d6030d2..cf54cc6 100644
--- a/gitosis/test/test_serve.py
+++ b/gitosis/test/test_serve.py
@@ -57,6 +57,18 @@ def test_bad_unsafeArguments():
eq(str(e), 'Arguments to command look dangerous')
assert isinstance(e, serve.ServingError)
+def test_bad_unsafeArguments_dotdot():
+ cfg = RawConfigParser()
+ e = assert_raises(
+ serve.UnsafeArgumentsError,
+ serve.serve,
+ cfg=cfg,
+ user='jdoe',
+ command='git-upload-pack something/../evil',
+ )
+ eq(str(e), 'Arguments to command look dangerous')
+ assert isinstance(e, serve.ServingError)
+
def test_bad_forbiddenCommand_read():
cfg = RawConfigParser()
e = assert_raises(