diff options
| author | eregon <eregon@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-04-28 19:50:06 +0000 |
|---|---|---|
| committer | eregon <eregon@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-04-28 19:50:06 +0000 |
| commit | 4fbb9aa3cb6c31ec128bfb31f59efa66d66adba4 (patch) | |
| tree | 84a654b260261fe172f2584f60b3ba93e59f841d /spec/ruby/security/cve_2018_6914_spec.rb | |
| parent | b864bd05bff2a61d55b08deb92e969f9fa55e07c (diff) | |
Update to ruby/spec@6f38a82
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63293 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'spec/ruby/security/cve_2018_6914_spec.rb')
| -rw-r--r-- | spec/ruby/security/cve_2018_6914_spec.rb | 59 |
1 files changed, 59 insertions, 0 deletions
diff --git a/spec/ruby/security/cve_2018_6914_spec.rb b/spec/ruby/security/cve_2018_6914_spec.rb new file mode 100644 index 0000000000..657341e474 --- /dev/null +++ b/spec/ruby/security/cve_2018_6914_spec.rb @@ -0,0 +1,59 @@ +require_relative '../spec_helper' + +require 'tempfile' + +guard -> { + ruby_version_is "2.3.7"..."2.4" or + ruby_version_is "2.4.4"..."2.5" or + ruby_version_is "2.5.1" +} do + describe "CVE-2018-6914 is resisted by" do + before :all do + @traversal_path = Array.new(Dir.pwd.split('/').count, '..').join('/') + Dir.pwd + '/' + @traversal_path.delete!(':') if /mswin|mingw/ =~ RUBY_PLATFORM + end + + it "Tempfile.open by deleting separators" do + begin + expect = Dir.glob(@traversal_path + '*').count + t = Tempfile.open([@traversal_path, 'foo']) + actual = Dir.glob(@traversal_path + '*').count + actual.should == expect + ensure + t.close! + end + end + + it "Tempfile.new by deleting separators" do + begin + expect = Dir.glob(@traversal_path + '*').count + t = Tempfile.new(@traversal_path + 'foo') + actual = Dir.glob(@traversal_path + '*').count + actual.should == expect + ensure + t.close! + end + end + + it "Tempfile.create by deleting separators" do + expect = Dir.glob(@traversal_path + '*').count + Tempfile.create(@traversal_path + 'foo') + actual = Dir.glob(@traversal_path + '*').count + actual.should == expect + end + + it "Dir.mktmpdir by deleting separators" do + expect = Dir.glob(@traversal_path + '*').count + Dir.mktmpdir(@traversal_path + 'foo') + actual = Dir.glob(@traversal_path + '*').count + actual.should == expect + end + + it "Dir.mktmpdir with an array by deleting separators" do + expect = Dir.glob(@traversal_path + '*').count + Dir.mktmpdir([@traversal_path, 'foo']) + actual = Dir.glob(@traversal_path + '*').count + actual.should == expect + end + end +end |