4 use RT::Test tests => 20;
6 my ($baseurl, $agent) = RT::Test->started_ok;
8 $agent->get("$baseurl/NoAuth/../Elements/HeaderJavascript");
9 is($agent->status, 400);
10 $agent->warning_like(qr/Invalid request.*aborting/,);
12 $agent->get("$baseurl/NoAuth/../%45lements/HeaderJavascript");
13 is($agent->status, 400);
14 $agent->warning_like(qr/Invalid request.*aborting/,);
16 $agent->get("$baseurl/NoAuth/%2E%2E/Elements/HeaderJavascript");
17 is($agent->status, 400);
18 $agent->warning_like(qr/Invalid request.*aborting/,);
20 $agent->get("$baseurl/NoAuth/../../../etc/RT_Config.pm");
21 is($agent->status, 400);
22 $agent->warning_like(qr/Invalid request.*aborting/,);
24 $agent->get("$baseurl/NoAuth/css/web2/images/../../../../../../etc/RT_Config.pm");
25 is($agent->status, 400);
26 $agent->warning_like(qr/Invalid request.*aborting/,);
28 # do not reject these URLs, even though they contain /. outside the path
29 $agent->get("$baseurl/index.html?ignored=%2F%2E");
30 is($agent->status, 200);
32 $agent->get("$baseurl/index.html?ignored=/.");
33 is($agent->status, 200);
35 $agent->get("$baseurl/index.html#%2F%2E");
36 is($agent->status, 200);
38 $agent->get("$baseurl/index.html#/.");
39 is($agent->status, 200);