Changeset 737:3d6eb6ad3655 in hatta-dev

Timestamp:

01/24/10 13:01:11 (2 years ago)

Author:

sheep@…

Branch:

default

Message:

add tests for forbidding access to symlinks

File:

• tests/test_repo.py (modified) (5 diffs)

tests/test_repo.py

@@ -13 +13 @@
 import hatta
 import py
+import werkzeug
 
 # Patch for no gettext
@@ -26 +27 @@
             os.remove(os.path.join(root, name))
         for name in dirs:
-            os.rmdir(os.path.join(root, name))
+            path = os.path.join(root, name)
+            if os.path.islink(path):
+                os.remove(path)
+            else:
+                os.rmdir(path)
     try:
         os.removedirs(top)
@@ -43 +48 @@
     return hatta.WikiStorage(repo_path)
 
+class TestMercurialStorage(object):
+    """
+    Groups tests specific to Hatta's default storage.
+    """
+
+    title = 'test title'
+    filename = 'test%20title'
+    author = u'test author'
+    text = u'test text'
+    comment = u'test comment'
+
+    def test_filename(self, repo):
+        """
+        Check if the page's file is named properly.
+        """
+
+        title = u'../some/+s page/ąęść?.txt'
+        filename = '..%2Fsome%2F%2Bs%20page%2F%C4%85%C4%99%C5%9B%C4%87%3F.txt'
+        filepath = os.path.join(repo.path, filename)
+        repo.save_text(title, self.text, self.author, self.comment, parent=-1)
+        assert os.path.exists(filepath)
+
+    def test_symlinks(self, repo):
+        """
+        Make sure access to symlinks is blocked.
+        """
+
+        path = os.path.join(repo.path, self.filename)
+        os.symlink('/', path)
+        py.test.raises(werkzeug.exceptions.Forbidden, repo.save_text,
+                       self.title, self.text, self.author, self.comment,
+                       parent=-1)
+        py.test.raises(werkzeug.exceptions.Forbidden, repo.open_page,
+                       self.title)
 
 class TestStorage(object):
@@ -60 +99 @@
         """
 
-        repo.save_text(self.title, self.text, self.author, self.comment, parent=-1)
+        repo.save_text(self.title, self.text, self.author, self.comment,
+                       parent=-1)
         saved = repo.open_page(self.title).read()
         assert saved == self.text
@@ -69 +109 @@
         """
 
-        repo.save_text(self.title, self.text, self.author, self.comment, parent=None)
+        repo.save_text(self.title, self.text, self.author, self.comment,
+                       parent=None)
         saved = repo.open_page(self.title).read()
         assert saved == self.text