← Back to branch summary

~thumper/wikkid/debian

« back to all changes in this revision

Viewing changes to wikkid/tests/test_app.py

  • Committer: Tim Penhey
  • Date: 2010-07-05 03:46:13 UTC
  • mfrom: (43.1.4 bug-601612)
  • Revision ID: tim@penhey.net-20100705034613-fq6n1vfsazunzm7f
Fix accessing other directories by using directory traversal in the URL - Gavin Panella

Show diffs side-by-side

added added

removed removed

Lines of Context:
wikkid/tests/test_app.py
6
6
 
7
7
"""Tests for method and classes in wikkid.app."""
8
8
 
 
9
import os.path
 
10
 
 
11
from wikkid.app import WikkidApp
 
12
from wikkid.filestore.volatile import FileStore
 
13
from wikkid.tests import TestCase
 
14
 
 
15
 
 
16
class TestApp(TestCase):
 
17
 
 
18
    def test_traverse_above_static_not_possible_with_relative_path(self):
 
19
        """
 
20
        Traversal above the static folder, by forging a malicious request with
 
21
        a relative path for example, is not possible.
 
22
        """
 
23
        environ = {
 
24
            "REQUEST_METHOD": "GET",
 
25
            "PATH_INFO": "/static/../page.html",
 
26
            }
 
27
 
 
28
        def start_response(status, headers):
 
29
            self.assertEqual("404 Not Found", status)
 
30
 
 
31
        filestore = FileStore()
 
32
        app = WikkidApp(filestore)
 
33
        app(environ, start_response)
 
34
 
 
35
    def test_traverse_above_static_not_possible_with_absolute_path(self):
 
36
        """
 
37
        Traversal above the static folder, by forging a malicious request
 
38
        including an absolute path for example, is not possible.
 
39
        """
 
40
        this_file = os.path.abspath(__file__)
 
41
        environ = {
 
42
            "REQUEST_METHOD": "GET",
 
43
            "PATH_INFO": "/static/" + this_file,
 
44
            }
 
45
 
 
46
        def start_response(status, headers):
 
47
            self.assertEqual("404 Not Found", status)
 
48
 
 
49
        filestore = FileStore()
 
50
        app = WikkidApp(filestore)
 
51
        app(environ, start_response)