Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SPR-8515 Check for traversal to parent directory via ../ in resource requests

Browse Source
This commit is contained in:
Rossen Stoyanchev
2011-07-22 16:27:33 +00:00
parent 5d2a84f39a
commit fd7e0b405b
2 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandlerTests.java
View File

@@ -122,6 +122,22 @@ public class ResourceHttpRequestHandlerTests {
assertEquals("function foo() { console.log(\"hello world\"); }", response.getContentAsString());
}
@Test
public void getResourceViaDirectoryTraversal() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setMethod("GET");
request.setAttribute(HandlerMapping.PATH_WITHIN_HANDLER_MAPPING_ATTRIBUTE, "../testsecret/secret.txt");
MockHttpServletResponse response = new MockHttpServletResponse();
handler.handleRequest(request, response);
assertEquals(404, response.getStatus());
request.setAttribute(HandlerMapping.PATH_WITHIN_HANDLER_MAPPING_ATTRIBUTE, "test/../../testsecret/secret.txt");
response = new MockHttpServletResponse();
handler.handleRequest(request, response);
assertEquals(404, response.getStatus());
}
@Test
public void notModified() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();