70 lines
2.3 KiB
Ruby
70 lines
2.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'spec_helper'
|
|
|
|
RSpec.describe API::Validations::Validators::FilePath do
|
|
include ApiValidatorsHelpers
|
|
|
|
subject do
|
|
described_class.new(['test'], params, false, scope.new)
|
|
end
|
|
|
|
context 'when allowlist is not set' do
|
|
shared_examples 'file validation' do
|
|
context 'valid file path' do
|
|
it 'does not raise a validation error' do
|
|
expect_no_validation_error('test' => './foo')
|
|
expect_no_validation_error('test' => './bar.rb')
|
|
expect_no_validation_error('test' => 'foo%2Fbar%2Fnew%2Ffile.rb')
|
|
expect_no_validation_error('test' => 'foo%2Fbar%2Fnew')
|
|
expect_no_validation_error('test' => 'foo/bar')
|
|
end
|
|
end
|
|
|
|
context 'invalid file path' do
|
|
it 'raise a validation error' do
|
|
expect_validation_error('test' => '../foo')
|
|
expect_validation_error('test' => '../')
|
|
expect_validation_error('test' => 'foo/../../bar')
|
|
expect_validation_error('test' => 'foo/../')
|
|
expect_validation_error('test' => 'foo/..')
|
|
expect_validation_error('test' => '../')
|
|
expect_validation_error('test' => '..\\')
|
|
expect_validation_error('test' => '..\/')
|
|
expect_validation_error('test' => '%2e%2e%2f')
|
|
expect_validation_error('test' => '/etc/passwd')
|
|
expect_validation_error('test' => 'test%0a/etc/passwd')
|
|
expect_validation_error('test' => '%2Ffoo%2Fbar%2Fnew%2Ffile.rb')
|
|
expect_validation_error('test' => '%252Ffoo%252Fbar%252Fnew%252Ffile.rb')
|
|
expect_validation_error('test' => 'foo%252Fbar%252Fnew%252Ffile.rb')
|
|
expect_validation_error('test' => 'foo%25252Fbar%25252Fnew%25252Ffile.rb')
|
|
end
|
|
end
|
|
end
|
|
|
|
it_behaves_like 'file validation' do
|
|
let(:params) { {} }
|
|
end
|
|
|
|
it_behaves_like 'file validation' do
|
|
let(:params) { true }
|
|
end
|
|
end
|
|
|
|
context 'when allowlist is set' do
|
|
let(:params) { { allowlist: ['/home/bar'] } }
|
|
|
|
context 'when file path is included in the allowlist' do
|
|
it 'does not raise a validation error' do
|
|
expect_no_validation_error('test' => '/home/bar')
|
|
end
|
|
end
|
|
|
|
context 'when file path is not included in the allowlist' do
|
|
it 'raises a validation error' do
|
|
expect_validation_error('test' => '/foo/xyz')
|
|
end
|
|
end
|
|
end
|
|
end
|