adding a test for directory traversal

rack · May 12, 2020 · 4d170b7 · 4d170b7
1 parent 145a0c5
commit 4d170b7
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/test/spec_directory.rb b/test/spec_directory.rb
@@ -119,6 +119,18 @@ def setup
     res.must_be :forbidden?
   end
 
+  it "not allow dir globs" do
+    Dir.mktmpdir do |dir|
+      weirds = "uploads/.?/.?"
+      full_dir = File.join(dir, weirds)
+      FileUtils.mkdir_p full_dir
+      FileUtils.touch File.join(dir, "secret.txt")
+      app = Rack::Directory.new(File.join(dir, "uploads"))
+      res = Rack::MockRequest.new(app).get("/.%3F")
+      refute_match "secret.txt", res.body
+    end
+  end
+
   it "404 if it can't find the file" do
     res = Rack::MockRequest.new(Rack::Lint.new(app)).
       get("/cgi/blubb")