2018-04-28 19:50:06 +00:00
|
|
|
require_relative '../spec_helper'
|
|
|
|
|
|
|
|
require 'tempfile'
|
|
|
|
|
2018-06-13 21:41:45 +00:00
|
|
|
describe "CVE-2018-6914 is resisted by" do
|
|
|
|
before :all do
|
|
|
|
@traversal_path = Array.new(Dir.pwd.split('/').count, '..').join('/') + Dir.pwd + '/'
|
|
|
|
@traversal_path.delete!(':') if /mswin|mingw/ =~ RUBY_PLATFORM
|
|
|
|
end
|
2018-04-28 19:50:06 +00:00
|
|
|
|
2018-06-13 21:41:45 +00:00
|
|
|
it "Tempfile.open by deleting separators" do
|
|
|
|
begin
|
2018-04-28 19:50:06 +00:00
|
|
|
expect = Dir.glob(@traversal_path + '*').count
|
2018-06-13 21:41:45 +00:00
|
|
|
t = Tempfile.open([@traversal_path, 'foo'])
|
2018-04-28 19:50:06 +00:00
|
|
|
actual = Dir.glob(@traversal_path + '*').count
|
|
|
|
actual.should == expect
|
2018-06-13 21:41:45 +00:00
|
|
|
ensure
|
|
|
|
t.close!
|
2018-04-28 19:50:06 +00:00
|
|
|
end
|
2018-06-13 21:41:45 +00:00
|
|
|
end
|
2018-04-28 19:50:06 +00:00
|
|
|
|
2018-06-13 21:41:45 +00:00
|
|
|
it "Tempfile.new by deleting separators" do
|
|
|
|
begin
|
2018-04-28 19:50:06 +00:00
|
|
|
expect = Dir.glob(@traversal_path + '*').count
|
2018-06-13 21:41:45 +00:00
|
|
|
t = Tempfile.new(@traversal_path + 'foo')
|
2018-04-28 19:50:06 +00:00
|
|
|
actual = Dir.glob(@traversal_path + '*').count
|
|
|
|
actual.should == expect
|
2018-06-13 21:41:45 +00:00
|
|
|
ensure
|
|
|
|
t.close!
|
2018-04-28 19:50:06 +00:00
|
|
|
end
|
2018-06-13 21:41:45 +00:00
|
|
|
end
|
2018-04-28 19:50:06 +00:00
|
|
|
|
2018-06-13 21:41:45 +00:00
|
|
|
it "Tempfile.create by deleting separators" do
|
|
|
|
expect = Dir.glob(@traversal_path + '*').count
|
2018-07-11 08:33:32 +00:00
|
|
|
Tempfile.create(@traversal_path + 'foo') do
|
|
|
|
actual = Dir.glob(@traversal_path + '*').count
|
|
|
|
actual.should == expect
|
|
|
|
end
|
2018-06-13 21:41:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
it "Dir.mktmpdir by deleting separators" do
|
|
|
|
expect = Dir.glob(@traversal_path + '*').count
|
2018-07-11 08:33:32 +00:00
|
|
|
Dir.mktmpdir(@traversal_path + 'foo') do
|
|
|
|
actual = Dir.glob(@traversal_path + '*').count
|
|
|
|
actual.should == expect
|
|
|
|
end
|
2018-06-13 21:41:45 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
it "Dir.mktmpdir with an array by deleting separators" do
|
|
|
|
expect = Dir.glob(@traversal_path + '*').count
|
2018-07-11 08:33:32 +00:00
|
|
|
Dir.mktmpdir([@traversal_path, 'foo']) do
|
|
|
|
actual = Dir.glob(@traversal_path + '*').count
|
|
|
|
actual.should == expect
|
|
|
|
end
|
2018-04-28 19:50:06 +00:00
|
|
|
end
|
|
|
|
end
|