rt/t/web/path-traversal.t

   1 use strict;
   2 use warnings;
   3
   4 use RT::Test tests => undef;
   5
   6 my ($baseurl, $agent) = RT::Test->started_ok;
   7 ok($agent->login);
   8
   9 $agent->get("$baseurl/NoAuth/../Elements/HeaderJavascript");
  10 is($agent->status, 400);
  11 $agent->warning_like(qr/Invalid request.*aborting/,);
  12
  13 $agent->get("$baseurl/NoAuth/../%45lements/HeaderJavascript");
  14 is($agent->status, 400);
  15 $agent->warning_like(qr/Invalid request.*aborting/,);
  16
  17 $agent->get("$baseurl/NoAuth/%2E%2E/Elements/HeaderJavascript");
  18 is($agent->status, 400);
  19 $agent->warning_like(qr/Invalid request.*aborting/,);
  20
  21 $agent->get("$baseurl/NoAuth/../../../etc/RT_Config.pm");
  22 is($agent->status, 400);
  23 SKIP: {
  24     skip "Apache rejects busting up above / for us", 2 if $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
  25     $agent->warning_like(qr/Invalid request.*aborting/,);
  26 };
  27
  28 $agent->get("$baseurl/NoAuth/css/web2/images/../../../../../../etc/RT_Config.pm");
  29 is($agent->status, 400);
  30 SKIP: {
  31     skip "Apache rejects busting up above / for us", 2 if $ENV{RT_TEST_WEB_HANDLER} =~ /^apache/;
  32     $agent->warning_like(qr/Invalid request.*aborting/,);
  33 };
  34
  35 # Do not reject a simple /. in the URL, for downloading uploaded
  36 # dotfiles, for example.
  37 $agent->get("$baseurl/Ticket/Attachment/28/9/.bashrc");
  38 is($agent->status, 200); # Even for a file not found, we return 200
  39 $agent->content_contains("Bad attachment id");
  40
  41 # do not reject these URLs, even though they contain /. outside the path
  42 $agent->get("$baseurl/index.html?ignored=%2F%2E");
  43 is($agent->status, 200);
  44
  45 $agent->get("$baseurl/index.html?ignored=/.");
  46 is($agent->status, 200);
  47
  48 $agent->get("$baseurl/index.html#%2F%2E");
  49 is($agent->status, 200);
  50
  51 $agent->get("$baseurl/index.html#/.");
  52 is($agent->status, 200);
  53
  54 undef $agent;
  55 done_testing;