This commit is contained in:
Kazuhiro NISHIYAMA 2019-11-09 16:43:47 +09:00
Родитель 43ceedecc0
Коммит 352096ef60
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 262ED8DBB4222F7A
1 изменённых файлов: 17 добавлений и 0 удалений

Просмотреть файл

@ -17,6 +17,18 @@ describe "CVE-2018-6914 is resisted by" do
sleep 0.1 sleep 0.1
end end
@debug_print = ->(actual) {
STDERR.puts({
actual: actual,
absolute: File.absolute_path(actual),
dir: @dir,
pwd: Dir.pwd,
tmpdir: @tmpdir,
Dir_tmpdir: Dir.tmpdir,
TMPDIR: ENV['TMPDIR'],
})
}
@dir << '/' @dir << '/'
@tempfile = nil @tempfile = nil
@ -31,12 +43,14 @@ describe "CVE-2018-6914 is resisted by" do
it "Tempfile.open by deleting separators" do it "Tempfile.open by deleting separators" do
@tempfile = Tempfile.open(['../', 'foo']) @tempfile = Tempfile.open(['../', 'foo'])
actual = @tempfile.path actual = @tempfile.path
@debug_print.call(actual)
File.absolute_path(actual).should.start_with?(@dir) File.absolute_path(actual).should.start_with?(@dir)
end end
it "Tempfile.new by deleting separators" do it "Tempfile.new by deleting separators" do
@tempfile = Tempfile.new('../foo') @tempfile = Tempfile.new('../foo')
actual = @tempfile.path actual = @tempfile.path
@debug_print.call(actual)
File.absolute_path(actual).should.start_with?(@dir) File.absolute_path(actual).should.start_with?(@dir)
end end
@ -44,6 +58,7 @@ describe "CVE-2018-6914 is resisted by" do
actual = Tempfile.create('../foo') do |t| actual = Tempfile.create('../foo') do |t|
t.path t.path
end end
@debug_print.call(actual)
File.absolute_path(actual).should.start_with?(@dir) File.absolute_path(actual).should.start_with?(@dir)
end end
@ -51,6 +66,7 @@ describe "CVE-2018-6914 is resisted by" do
actual = Dir.mktmpdir('../foo') do |path| actual = Dir.mktmpdir('../foo') do |path|
path path
end end
@debug_print.call(actual)
File.absolute_path(actual).should.start_with?(@dir) File.absolute_path(actual).should.start_with?(@dir)
end end
@ -58,6 +74,7 @@ describe "CVE-2018-6914 is resisted by" do
actual = Dir.mktmpdir(['../', 'foo']) do |path| actual = Dir.mktmpdir(['../', 'foo']) do |path|
path path
end end
@debug_print.call(actual)
File.absolute_path(actual).should.start_with?(@dir) File.absolute_path(actual).should.start_with?(@dir)
end end
end end