mirror of
https://github.com/graygnuorg/pound.git
synced 2026-10-23 22:28:53 +03:00
6205944da5
* src/http.c (safe_pathname_p): New function. (acme_response, file_response): Disallow invalid file names and symlinks. * tests/acme.at: Test invalid file name handling. * tests/sendfile.at: Likewise.
92 lines
1.6 KiB
Plaintext
92 lines
1.6 KiB
Plaintext
# This file is part of pound testsuite. -*- autotest -*-
|
|
# Copyright (C) 2025-2026 Sergey Poznyakoff
|
|
#
|
|
# Pound is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Pound is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with pound. If not, see <http://www.gnu.org/licenses/>.
|
|
AT_SETUP([SendFile backend])
|
|
AT_KEYWORDS([sendfile file])
|
|
|
|
m4_pushdef([ARAR],
|
|
[Flumen est Arar, quod per fines Haeduorum et Sequanorum in Rhodanum influit,
|
|
incredibili lenitate, ita ut oculis in utram partem fluat iudicari non possit.])
|
|
|
|
AT_DATA([arar.txt],[ARAR
|
|
])
|
|
|
|
PT_CHECK([ListenHTTP
|
|
Service
|
|
SendFile "."
|
|
End
|
|
End
|
|
],
|
|
[GET /arar.txt
|
|
end
|
|
|
|
200
|
|
Content-Type: text/plain
|
|
|
|
ARAR
|
|
end
|
|
])
|
|
|
|
PT_CHECK([ListenHTTP
|
|
Service
|
|
Path -re "/public/(.+)"
|
|
SetPath "$1"
|
|
Rewrite response
|
|
SetHeader "Content-Type: text/html"
|
|
End
|
|
SendFile "."
|
|
End
|
|
End
|
|
],
|
|
[GET /public/arar.txt
|
|
end
|
|
|
|
200
|
|
Content-Type: text/html
|
|
|
|
ARAR
|
|
end
|
|
])
|
|
|
|
# Test if pathnames with ../ are rejected.
|
|
AT_CHECK([mkdir static
|
|
AT_DATA([static/arar.txt],[ARAR
|
|
])])
|
|
|
|
PT_CHECK([ListenHTTP
|
|
Service
|
|
SendFile "static"
|
|
End
|
|
End
|
|
],
|
|
[GET /arar.txt
|
|
end
|
|
|
|
200
|
|
Content-Type: text/plain
|
|
|
|
ARAR
|
|
end
|
|
|
|
GET ../pound.cfg
|
|
end
|
|
|
|
404
|
|
end
|
|
])
|
|
|
|
m4_popdef([ARAR])
|
|
|
|
AT_CLEANUP |