diff options
author | Alejandro Rodríguez <alejorro70@gmail.com> | 2017-05-11 21:32:05 +0300 |
---|---|---|
committer | Alejandro Rodríguez <alejorro70@gmail.com> | 2017-05-16 18:52:09 +0300 |
commit | 703355a4b68ab9c4ab28817838f5db2cc5b9337f (patch) | |
tree | 65b07ef95b1766dd026b39cc30f12597d011c2da /internal/helper/repo_test.go | |
parent | b37b2d2319569bea1d77c8e9a71484bd9dd5270e (diff) |
Disallow directory traversal in repository paths for security
Diffstat (limited to 'internal/helper/repo_test.go')
-rw-r--r-- | internal/helper/repo_test.go | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/internal/helper/repo_test.go b/internal/helper/repo_test.go index 07ea8b409..29e3daa7b 100644 --- a/internal/helper/repo_test.go +++ b/internal/helper/repo_test.go @@ -96,6 +96,42 @@ func TestGetRepoPath(t *testing.T) { repo: &pb.Repository{Path: "/made/up/path.git"}, err: codes.NotFound, }, + { + desc: "relative path with directory traversal", + storages: exampleStorages, + repo: &pb.Repository{StorageName: "default", RelativePath: "../bazqux.git"}, + err: codes.InvalidArgument, + }, + { + desc: "valid path with ..", + storages: exampleStorages, + repo: &pb.Repository{StorageName: "default", RelativePath: "foo../bazqux.git"}, + err: codes.NotFound, // Because the directory doesn't exist + }, + { + desc: "relative path with sneaky directory traversal", + storages: exampleStorages, + repo: &pb.Repository{StorageName: "default", RelativePath: "/../bazqux.git"}, + err: codes.InvalidArgument, + }, + { + desc: "relative path with one level traversal at the end", + storages: exampleStorages, + repo: &pb.Repository{StorageName: "default", RelativePath: testhelper.TestRelativePath + "/.."}, + err: codes.InvalidArgument, + }, + { + desc: "relative path with one level dashed traversal at the end", + storages: exampleStorages, + repo: &pb.Repository{StorageName: "default", RelativePath: testhelper.TestRelativePath + "/../"}, + err: codes.InvalidArgument, + }, + { + desc: "relative path with deep traversal at the end", + storages: exampleStorages, + repo: &pb.Repository{StorageName: "default", RelativePath: "bazqux.git/../.."}, + err: codes.InvalidArgument, + }, } for _, tc := range testCases { |