rt/t/web/path-traversal.t

   1 use strict;
   2 use warnings;
   3
   4 use RT::Test tests => 22;
   5
   6 my ($baseurl, $agent) = RT::Test->started_ok;
   7
   8 $agent->get("$baseurl/NoAuth/../Elements/HeaderJavascript");
   9 is($agent->status, 400);
  10 $agent->warning_like(qr/Invalid request.*aborting/,);
  11
  12 $agent->get("$baseurl/NoAuth/../%45lements/HeaderJavascript");
  13 is($agent->status, 400);
  14 $agent->warning_like(qr/Invalid request.*aborting/,);
  15
  16 $agent->get("$baseurl/NoAuth/%2E%2E/Elements/HeaderJavascript");
  17 is($agent->status, 400);
  18 $agent->warning_like(qr/Invalid request.*aborting/,);
  19
  20 $agent->get("$baseurl/NoAuth/../../../etc/RT_Config.pm");
  21 is($agent->status, 400);
  22 SKIP: {
  23     skip "Apache rejects busting up above / for us", 2 if $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
  24     $agent->warning_like(qr/Invalid request.*aborting/,);
  25 };
  26
  27 $agent->get("$baseurl/NoAuth/css/web2/images/../../../../../../etc/RT_Config.pm");
  28 is($agent->status, 400);
  29 SKIP: {
  30     skip "Apache rejects busting up above / for us", 2 if $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
  31     $agent->warning_like(qr/Invalid request.*aborting/,);
  32 };
  33
  34 # do not reject these URLs, even though they contain /. outside the path
  35 $agent->get("$baseurl/index.html?ignored=%2F%2E");
  36 is($agent->status, 200);
  37
  38 $agent->get("$baseurl/index.html?ignored=/.");
  39 is($agent->status, 200);
  40
  41 $agent->get("$baseurl/index.html#%2F%2E");
  42 is($agent->status, 200);
  43
  44 $agent->get("$baseurl/index.html#/.");
  45 is($agent->status, 200);
  46