File: spec_directory.rb

package info (click to toggle)
ruby-rack 2.1.4-3
  • links: PTS, VCS
  • area: main
  • in suites: bullseye, sid
  • size: 1,492 kB
  • sloc: ruby: 14,778; sh: 12; makefile: 6; javascript: 1
file content (162 lines) | stat: -rw-r--r-- 4,239 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
# frozen_string_literal: true

require 'minitest/global_expectations/autorun'
require 'rack/directory'
require 'rack/lint'
require 'rack/mock'
require 'tempfile'
require 'fileutils'

describe Rack::Directory do
  DOCROOT = File.expand_path(File.dirname(__FILE__)) unless defined? DOCROOT
  FILE_CATCH = proc{|env| [200, { 'Content-Type' => 'text/plain', "Content-Length" => "7" }, ['passed!']] }

  attr_reader :app

  def setup
    @app = Rack::Lint.new(Rack::Directory.new(DOCROOT, FILE_CATCH))
  end

  it 'serves directories with + in the name' do
    Dir.mktmpdir do |dir|
      plus_dir = "foo+bar"
      full_dir = File.join(dir, plus_dir)
      FileUtils.mkdir full_dir
      FileUtils.touch File.join(full_dir, "omg.txt")
      app = Rack::Directory.new(dir, FILE_CATCH)
      env = Rack::MockRequest.env_for("/#{plus_dir}/")
      status, _, body = app.call env

      assert_equal 200, status

      str = ''.dup
      body.each { |x| str << x }
      assert_match "foo+bar", str
    end
  end

  it "serve directory indices" do
    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/cgi/")

    res.must_be :ok?
    assert_match(res, /<html><head>/)
  end

  it "pass to app if file found" do
    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/cgi/test")

    res.must_be :ok?
    assert_match(res, /passed!/)
  end

  it "serve uri with URL encoded filenames" do
    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/%63%67%69/") # "/cgi/test"

    res.must_be :ok?
    assert_match(res, /<html><head>/)

    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/cgi/%74%65%73%74") # "/cgi/test"

    res.must_be :ok?
    assert_match(res, /passed!/)
  end

  it "serve uri with URL encoded null byte (%00) in filenames" do
    res = Rack::MockRequest.new(Rack::Lint.new(app))
      .get("/cgi/test%00")

    res.must_be :bad_request?
  end

  it "not allow directory traversal" do
    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/cgi/../test")

    res.must_be :forbidden?

    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/cgi/%2E%2E/test")

    res.must_be :forbidden?
  end

  it "not allow dir globs" do
    Dir.mktmpdir do |dir|
      weirds = "uploads/.?/.?"
      full_dir = File.join(dir, weirds)
      FileUtils.mkdir_p full_dir
      FileUtils.touch File.join(dir, "secret.txt")
      app = Rack::Directory.new(File.join(dir, "uploads"))
      res = Rack::MockRequest.new(app).get("/.%3F")
      refute_match "secret.txt", res.body
    end
  end

  it "404 if it can't find the file" do
    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      get("/cgi/blubb")

    res.must_be :not_found?
  end

  it "uri escape path parts" do # #265, properly escape file names
    mr = Rack::MockRequest.new(Rack::Lint.new(app))

    res = mr.get("/cgi/test%2bdirectory")

    res.must_be :ok?
    res.body.must_match(%r[/cgi/test\+directory/test\+file])

    res = mr.get("/cgi/test%2bdirectory/test%2bfile")
    res.must_be :ok?
  end

  it "correctly escape script name with spaces" do
    Dir.mktmpdir do |dir|
      space_dir = "foo bar"
      full_dir = File.join(dir, space_dir)
      FileUtils.mkdir full_dir
      FileUtils.touch File.join(full_dir, "omg omg.txt")
      app = Rack::Directory.new(dir, FILE_CATCH)
      env = Rack::MockRequest.env_for(Rack::Utils.escape_path("/#{space_dir}/"))
      status, _, body = app.call env

      assert_equal 200, status

      str = ''.dup
      body.each { |x| str << x }
      assert_match "/foo%20bar/omg%20omg.txt", str
    end
  end

  it "correctly escape script name" do
    _app = app
    app2 = Rack::Builder.new do
      map '/script-path' do
        run _app
      end
    end

    mr = Rack::MockRequest.new(Rack::Lint.new(app2))

    res = mr.get("/script-path/cgi/test%2bdirectory")

    res.must_be :ok?
    res.body.must_match(%r[/script-path/cgi/test\+directory/test\+file])

    res = mr.get("/script-path/cgi/test+directory/test+file")
    res.must_be :ok?
  end

  it "return error when file not found for head request" do
    res = Rack::MockRequest.new(Rack::Lint.new(app)).
      head("/cgi/missing")

    res.must_be :not_found?
    res.body.must_be :empty?
  end
end