Navigation

Changeset 963

Timestamp:

02/19/08 23:48:42 (7 months ago)

Author:

evanweaver

Message:

Failing test for pass traversal issue.

Files:

r927	r963
8	8	require 'zlib'
9	9	require 'yaml'
10
11	10
12	11	module Mongrel
…	…
103	102	# If you pass nil as the root path, it will not check any locations or
104	103	# expand any paths. This lets you serve files from multiple drives
105		# on win32.
	104	# on win32. It should probably not be used in a public-facing way
	105	# without additional checks.
106	106	#
107	107	# The default content type is "text/plain; charset=ISO-8859-1" but you
…	…
121	121	def initialize(path, listing_allowed=true, index_html="index.html")
122	122	@path = File.expand_path(path) if path
123		@listing_allowed=listing_allowed
	123	@listing_allowed = listing_allowed
124	124	@index_html = index_html
125	125	@default_content_type = "application/octet-stream".freeze
…	…
133	133	req_path = File.join(@path, req_path) if @path
134	134	req_path = File.expand_path req_path
135
136		# do not remove the check for @path at the beginning, it's what prevents
137		# the serving of arbitrary files (and good programmer Rule #1 Says: If
138		# you don't understand something, it's not because I'm stupid, it's
139		# because you are).
140		if req_path.index(@path) == 0 and File.exist? req_path
	135
	136	if File.exist? req_path # and (!@path or req_path.index(@path) == 0)
141	137	# It exists and it's in the right location
142	138	if File.directory? req_path
…	…
158	154	end
159	155	else
160		# does not exist or isn't in the right spot ~~or isn't valid because not start with @path~~
	156	# does not exist or isn't in the right spot
161	157	return nil
162	158	end

r740	r963
50	50	end
51	51	end
	52
	53	File.open("/tmp/testfile", 'w') do
	54	# Do nothing
	55	end
	56
52	57	@config.run
53	58	end
…	…
55	60	def teardown
56	61	@config.stop(false, true)
	62	File.delete "/tmp/testfile"
57	63	end
58	64
…	…
67	73	"http://localhost:9998/status",
68	74	])
69
70		~~# XXX This can't possibly have good coverage.~~
71	75	check_status res, String
	76	end
	77
	78	def test_nil_dirhandler
	79	# Camping uses this internally
	80	handler = Mongrel::DirHandler.new(nil, false)
	81	assert handler.can_serve("/tmp/testfile")
	82	# Not a bug! A nil @file parameter is the only circumstance under which
	83	# we are allowed to serve any existing file
	84	assert handler.can_serve("../../../../../../../../../../tmp/testfile")
	85	end
	86
	87	def test_non_nil_dirhandler_is_not_vulnerable_to_path_traversal
	88	# The famous security bug of Mongrel 1.1.2
	89	handler = Mongrel::DirHandler.new("/doc", false)
	90	assert_nil handler.can_serve("/tmp/testfile")
	91	assert_nil handler.can_serve("../../../../../../../../../../tmp/testfile")
72	92	end
73	93
74	94	def test_deflate
75	95	Net::HTTP.start("localhost", 9998) do \|h\|
76		# test that no accept-encoding returns a non-deflated response
	96	# Test that no accept-encoding returns a non-deflated response
77	97	req = h.get("/dumb")
78	98	assert(