test: traversal attack

demarches-simplifiees · Jul 3, 2023 · 20d49ed · 20d49ed
1 parent 29c399d
commit 20d49ed
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/tests/fixtures/server-static/uploads/out_of_jail.txt b/tests/fixtures/server-static/uploads/out_of_jail.txt
@@ -0,0 +1 @@
+fail
diff --git a/tests/helpers/curl.rs b/tests/helpers/curl.rs
@@ -5,6 +5,7 @@ pub fn curl_get_status(url: &str) -> String {
     let stdout = Command::new("curl")
         .arg("-XGET")
         .arg(url)
+        .arg("--path-as-is")
         .arg("-o")
         .arg("/dev/null")
         .arg("-s")

diff --git a/tests/traversal_attack.rs b/tests/traversal_attack.rs
@@ -0,0 +1,14 @@
+use serial_test::serial;
+
+mod helpers;
+pub use helpers::*;
+
+#[test]
+#[serial(servers)]
+fn traversal_attack_is_avoided() {
+    let _proxy_and_node = ProxyAndNode::start();
+
+    let curl_download = curl_get_status("localhost:4444/upstream/../../out_of_jail.txt");
+    println!("curl_download: {:?}", curl_download);
+    assert_eq!(curl_download, "404");
+}