diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2020-02-27 00:09:11 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2020-02-27 00:09:11 +0300 |
commit | f82d5dcab7c3d9a672abc827c92f86887b683a7d (patch) | |
tree | 4a4379a82ab825185aaeafdfb9eb0f9029dc286c /spec/lib | |
parent | 619d0b6922a6cf95d291fbbf5fa3d09e772a1ea8 (diff) |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'spec/lib')
-rw-r--r-- | spec/lib/api/helpers/custom_validators_spec.rb | 59 | ||||
-rw-r--r-- | spec/lib/gitlab/utils_spec.rb | 8 |
2 files changed, 53 insertions, 14 deletions
diff --git a/spec/lib/api/helpers/custom_validators_spec.rb b/spec/lib/api/helpers/custom_validators_spec.rb index 1ebce2ab5c4..10505210e65 100644 --- a/spec/lib/api/helpers/custom_validators_spec.rb +++ b/spec/lib/api/helpers/custom_validators_spec.rb @@ -24,7 +24,38 @@ describe API::Helpers::CustomValidators do context 'invalid parameters' do it 'raises a validation error' do - expect_validation_error({ 'test' => 'some_value' }) + expect_validation_error('test' => 'some_value') + end + end + end + + describe API::Helpers::CustomValidators::FilePath do + subject do + described_class.new(['test'], {}, false, scope.new) + end + + context 'valid file path' do + it 'does not raise a validation error' do + expect_no_validation_error('test' => './foo') + expect_no_validation_error('test' => './bar.rb') + expect_no_validation_error('test' => 'foo%2Fbar%2Fnew%2Ffile.rb') + expect_no_validation_error('test' => 'foo%2Fbar%2Fnew') + expect_no_validation_error('test' => 'foo%252Fbar%252Fnew%252Ffile.rb') + end + end + + context 'invalid file path' do + it 'raise a validation error' do + expect_validation_error('test' => '../foo') + expect_validation_error('test' => '../') + expect_validation_error('test' => 'foo/../../bar') + expect_validation_error('test' => 'foo/../') + expect_validation_error('test' => 'foo/..') + expect_validation_error('test' => '../') + expect_validation_error('test' => '..\\') + expect_validation_error('test' => '..\/') + expect_validation_error('test' => '%2e%2e%2f') + expect_validation_error('test' => '/etc/passwd') end end end @@ -36,12 +67,12 @@ describe API::Helpers::CustomValidators do context 'valid parameters' do it 'does not raise a validation error' do - expect_no_validation_error({ 'test' => 2 }) - expect_no_validation_error({ 'test' => 100 }) - expect_no_validation_error({ 'test' => 'None' }) - expect_no_validation_error({ 'test' => 'Any' }) - expect_no_validation_error({ 'test' => 'none' }) - expect_no_validation_error({ 'test' => 'any' }) + expect_no_validation_error('test' => 2) + expect_no_validation_error('test' => 100) + expect_no_validation_error('test' => 'None') + expect_no_validation_error('test' => 'Any') + expect_no_validation_error('test' => 'none') + expect_no_validation_error('test' => 'any') end end @@ -59,18 +90,18 @@ describe API::Helpers::CustomValidators do context 'valid parameters' do it 'does not raise a validation error' do - expect_no_validation_error({ 'test' => [] }) - expect_no_validation_error({ 'test' => [1, 2, 3] }) - expect_no_validation_error({ 'test' => 'None' }) - expect_no_validation_error({ 'test' => 'Any' }) - expect_no_validation_error({ 'test' => 'none' }) - expect_no_validation_error({ 'test' => 'any' }) + expect_no_validation_error('test' => []) + expect_no_validation_error('test' => [1, 2, 3]) + expect_no_validation_error('test' => 'None') + expect_no_validation_error('test' => 'Any') + expect_no_validation_error('test' => 'none') + expect_no_validation_error('test' => 'any') end end context 'invalid parameters' do it 'raises a validation error' do - expect_validation_error({ 'test' => 'some_other_string' }) + expect_validation_error('test' => 'some_other_string') end end end diff --git a/spec/lib/gitlab/utils_spec.rb b/spec/lib/gitlab/utils_spec.rb index 85a536ee6ad..48fc2d826bc 100644 --- a/spec/lib/gitlab/utils_spec.rb +++ b/spec/lib/gitlab/utils_spec.rb @@ -31,6 +31,14 @@ describe Gitlab::Utils do it 'does nothing for a safe string' do expect(check_path_traversal!('./foo')).to eq('./foo') end + + it 'does nothing if an absolute path is allowed' do + expect(check_path_traversal!('/etc/folder/path', allowed_absolute: true)). to eq('/etc/folder/path') + end + + it 'raises exception if an absolute path is not allowed' do + expect { check_path_traversal!('/etc/folder/path') }.to raise_error(/Invalid path/) + end end describe '.slugify' do |