mirror of
https://github.com/d9pouces/id_configurator.git
synced 2026-11-09 01:47:21 +01:00
feat: sanitize filenames in apt and yum modules to prevent path traversal
Signed-off-by: d9pouces <github@19pouces.net>
This commit is contained in:
@@ -1,5 +1,10 @@
|
||||
from id_configurator.modules import base as base_module
|
||||
from id_configurator.modules.base import Module, all_modules, register
|
||||
from id_configurator.modules.base import (
|
||||
Module,
|
||||
all_modules,
|
||||
register,
|
||||
sanitize_filename,
|
||||
)
|
||||
|
||||
|
||||
def test_register_and_all_modules_are_isolated(monkeypatch) -> None:
|
||||
@@ -17,3 +22,15 @@ def test_register_and_all_modules_are_isolated(monkeypatch) -> None:
|
||||
register(DummyModule)
|
||||
|
||||
assert all_modules() == [DummyModule]
|
||||
|
||||
|
||||
def test_sanitize_filename_leaves_plain_names_untouched() -> None:
|
||||
assert sanitize_filename("interdiode") == "interdiode"
|
||||
|
||||
|
||||
def test_sanitize_filename_replaces_forward_slash() -> None:
|
||||
assert sanitize_filename("../../etc/passwd") == ".._.._etc_passwd"
|
||||
|
||||
|
||||
def test_sanitize_filename_replaces_backslash() -> None:
|
||||
assert sanitize_filename(r"a\b") == "a_b"
|
||||
|
||||
Reference in New Issue
Block a user