Git-Mirrors/mat2-web
1
0
Fork 0
mirror of https://0xacab.org/jvoisin/mat2-web.git synced 2025-05-12 03:05:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

validate bulk body is parsable

Browse source
This commit is contained in:
jfriedli 2021-08-23 20:56:49 +02:00
parent 0219faa020
commit a60a0c845f
No known key found for this signature in database
GPG key ID: B0C0A4C9085372B7
2 changed files with 26 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
test/test_api.py
View file

@ -413,6 +413,24 @@ class Mat2APITestCase(unittest.TestCase):
request = app.get(download_link)
self.assertEqual(code, request.status_code)
def test_download_naughty_input(self):
request = self.app.get(
'/api/download/%F2%8C%BF%BD%F1%AE%98%A3%E4%B7%B8%F2%9B%94%BE%F2%A7%8B%83%F1%B1%80%9F%F3%AA%89%A6/1p/str'
)
error_message = request.get_json()['message']
self.assertEqual(404, request.status_code)
self.assertEqual("File not found", error_message)
def test_download_bulk_naughty_input(self):
request = self.app.post(
'/api/download/bulk',
data='\"\'\'\'&type %SYSTEMROOT%\\\\win.ini\"',
headers={'content-type': 'application/json'}
)
error_message = request.get_json()['message']
self.assertEqual(400, request.status_code)
self.assertEqual("Invalid Post Body", error_message)
def test_upload_naughty_input(self):
request = self.app.post('/api/upload',
data='{"file_name": "\\\\", '