diff options
author | Mark Chao <mchao@gitlab.com> | 2019-02-13 11:24:26 +0300 |
---|---|---|
committer | Mark Chao <mchao@gitlab.com> | 2019-02-21 11:44:44 +0300 |
commit | d72b1cd0b5b01d6fec6b93d9dfe84f8302083072 (patch) | |
tree | 8b37b49971929fb56b1f72554f227f8be6a8cb0c /spec/uploaders | |
parent | a9291f15ea10e3cfc94282ffb4e0969e9d4175eb (diff) |
Check snippet attached file to be moved is within designated directory
Previously one could move any temp/ sub folder around.
Diffstat (limited to 'spec/uploaders')
-rw-r--r-- | spec/uploaders/file_mover_spec.rb | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/spec/uploaders/file_mover_spec.rb b/spec/uploaders/file_mover_spec.rb index a28d7445b1c..e474a714b10 100644 --- a/spec/uploaders/file_mover_spec.rb +++ b/spec/uploaders/file_mover_spec.rb @@ -1,6 +1,8 @@ require 'spec_helper' describe FileMover do + include FileMoverHelpers + let(:filename) { 'banana_sample.gif' } let(:temp_file_path) { File.join('uploads/-/system/temp', 'secret55', filename) } @@ -19,6 +21,8 @@ describe FileMover do expect(FileUtils).to receive(:move).with(a_string_including(temp_file_path), a_string_including(file_path)) allow_any_instance_of(CarrierWave::SanitizedFile).to receive(:exists?).and_return(true) allow_any_instance_of(CarrierWave::SanitizedFile).to receive(:size).and_return(10) + + stub_file_mover(temp_file_path) end context 'when move and field update successful' do @@ -65,4 +69,30 @@ describe FileMover do end end end + + context 'security' do + context 'when relative path is involved' do + let(:temp_file_path) { File.join('uploads/-/system/temp', '..', 'another_subdir_of_temp') } + + it 'does not trigger move if path is outside designated directory' do + stub_file_mover('uploads/-/system/another_subdir_of_temp') + expect(FileUtils).not_to receive(:move) + + subject + + expect(snippet.reload.description).to eq(temp_description) + end + end + + context 'when symlink is involved' do + it 'does not trigger move if path is outside designated directory' do + stub_file_mover(temp_file_path, stub_real_path: Pathname('/etc')) + expect(FileUtils).not_to receive(:move) + + subject + + expect(snippet.reload.description).to eq(temp_description) + end + end + end end |