Sanitize resource path along with rootResourcePath

This commit is contained in:
James Allen
2016-09-21 15:09:01 +01:00
parent 9f49dc8554
commit 79b3d2172b
2 changed files with 19 additions and 3 deletions

View File

@@ -42,7 +42,13 @@ module.exports = RequestParser =
compile.rootResourcePath compile.rootResourcePath
default: "main.tex" default: "main.tex"
type: "string" type: "string"
response.rootResourcePath = RequestParser._sanitizePath(rootResourcePath) originalRootResourcePath = rootResourcePath
sanitizedRootResourcePath = RequestParser._sanitizePath(rootResourcePath)
response.rootResourcePath = sanitizedRootResourcePath
for resource in response.resources
if resource.path == originalRootResourcePath
resource.path = sanitizedRootResourcePath
catch error catch error
return callback error return callback error

View File

@@ -206,11 +206,21 @@ describe "RequestParser", ->
describe "with a root resource path that needs escaping", -> describe "with a root resource path that needs escaping", ->
beforeEach -> beforeEach ->
@validRequest.compile.rootResourcePath = "`rm -rf foo`.tex" @badPath = "`rm -rf foo`.tex"
@goodPath = "rm -rf foo.tex"
@validRequest.compile.rootResourcePath = @badPath
@validRequest.compile.resources.push {
path: @badPath
date: "12:00 01/02/03"
content: "Hello world"
}
@RequestParser.parse @validRequest, @callback @RequestParser.parse @validRequest, @callback
@data = @callback.args[0][1] @data = @callback.args[0][1]
it "should return the escaped resource", -> it "should return the escaped resource", ->
@data.rootResourcePath.should.equal "rm -rf foo.tex" @data.rootResourcePath.should.equal @goodPath
it "should also escape the resource path", ->
@data.resources[0].path.should.equal @goodPath