mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem.

Browse Source 
Thanks to Dennis Brinkrolf for the report.
This commit is contained in:
Florian Apolloner
2021-12-17 21:07:50 +01:00
committed by Carlton Gibson
parent 761f449e0d
commit 6d343d01c5
6 changed files with 42 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
tests/file_storage/test_generate_filename.py
View File

@@ -53,13 +53,20 @@ class GenerateFilenameStorageTests(SimpleTestCase):
s.generate_filename(file_name)
def test_storage_dangerous_paths_dir_name(self):
file_name = '/tmp/../path'
candidates = [
('tmp/../path', 'tmp/..'),
('tmp\\..\\path', 'tmp/..'),
('/tmp/../path', '/tmp/..'),
('\\tmp\\..\\path', '/tmp/..'),
]
s = FileSystemStorage()
msg = "Detected path traversal attempt in '/tmp/..'"
with self.assertRaisesMessage(SuspiciousFileOperation, msg):
s.get_available_name(file_name)
with self.assertRaisesMessage(SuspiciousFileOperation, msg):
s.generate_filename(file_name)
for file_name, path in candidates:
msg = "Detected path traversal attempt in '%s'" % path
with self.subTest(file_name=file_name):
with self.assertRaisesMessage(SuspiciousFileOperation, msg):
s.get_available_name(file_name)
with self.assertRaisesMessage(SuspiciousFileOperation, msg):
s.generate_filename(file_name)
def test_filefield_dangerous_filename(self):
candidates = [