Sanitize resource path along with rootResourcePath
This commit is contained in:
@@ -42,7 +42,13 @@ module.exports = RequestParser =
|
|||||||
compile.rootResourcePath
|
compile.rootResourcePath
|
||||||
default: "main.tex"
|
default: "main.tex"
|
||||||
type: "string"
|
type: "string"
|
||||||
response.rootResourcePath = RequestParser._sanitizePath(rootResourcePath)
|
originalRootResourcePath = rootResourcePath
|
||||||
|
sanitizedRootResourcePath = RequestParser._sanitizePath(rootResourcePath)
|
||||||
|
response.rootResourcePath = sanitizedRootResourcePath
|
||||||
|
|
||||||
|
for resource in response.resources
|
||||||
|
if resource.path == originalRootResourcePath
|
||||||
|
resource.path = sanitizedRootResourcePath
|
||||||
catch error
|
catch error
|
||||||
return callback error
|
return callback error
|
||||||
|
|
||||||
|
|||||||
@@ -206,11 +206,21 @@ describe "RequestParser", ->
|
|||||||
|
|
||||||
describe "with a root resource path that needs escaping", ->
|
describe "with a root resource path that needs escaping", ->
|
||||||
beforeEach ->
|
beforeEach ->
|
||||||
@validRequest.compile.rootResourcePath = "`rm -rf foo`.tex"
|
@badPath = "`rm -rf foo`.tex"
|
||||||
|
@goodPath = "rm -rf foo.tex"
|
||||||
|
@validRequest.compile.rootResourcePath = @badPath
|
||||||
|
@validRequest.compile.resources.push {
|
||||||
|
path: @badPath
|
||||||
|
date: "12:00 01/02/03"
|
||||||
|
content: "Hello world"
|
||||||
|
}
|
||||||
@RequestParser.parse @validRequest, @callback
|
@RequestParser.parse @validRequest, @callback
|
||||||
@data = @callback.args[0][1]
|
@data = @callback.args[0][1]
|
||||||
|
|
||||||
it "should return the escaped resource", ->
|
it "should return the escaped resource", ->
|
||||||
@data.rootResourcePath.should.equal "rm -rf foo.tex"
|
@data.rootResourcePath.should.equal @goodPath
|
||||||
|
|
||||||
|
it "should also escape the resource path", ->
|
||||||
|
@data.resources[0].path.should.equal @goodPath
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user