Skip to content

Commit f3edaa3

Browse files
committed
Make more test repos with traversal-attempting blob names
The approach in make_traverse_literal_slases.sh works about equally well for any top level file with strange characters. Before, it was only generating such repositores where the filename has slashes, causing traversal on all platforms. This has is generate two more repositories, with backslashes instead of slashes. That script's name is accordingly updated to make_traverse_literal_separators.sh. Note that while such names with backslashes may be blocked on multiple systems under various circumstances, they will only perform traversal on Windows.
1 parent 6f44aca commit f3edaa3

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

gix-worktree/tests/fixtures/make_traverse_literal_slashes.sh renamed to gix-worktree/tests/fixtures/make_traverse_literal_separators.sh

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,17 @@ function make_repo() (
2727
make_repo traverse_dotdot_slashes ../outside 100644 \
2828
<<<'A file outside the working tree, somehow.'
2929

30-
# TODO: Should the payload be simplified to a single side effect for tests to check?
3130
make_repo traverse_dotgit_slashes .git/hooks/pre-commit 100755 <<'EOF'
3231
#!/bin/sh
3332
printf 'Vulnerable!\n'
3433
date >vulnerable
3534
EOF
35+
36+
make_repo traverse_dotdot_backslashes '..\outside' 100644 \
37+
<<<'A file outside the working tree, somehow.'
38+
39+
make_repo traverse_dotgit_backslashes '.git\hooks\pre-commit' 100755 <<'EOF'
40+
#!/bin/sh
41+
printf 'Vulnerable!\n'
42+
date >vulnerable
43+
EOF

0 commit comments

Comments
 (0)