Merge branch 'tseaver-jp_exploit_fix'

1 files changed, 20 insertions, 0 deletions

diff --git a/tests/test_integration.py b/tests/test_integration.py
index 0b55872d2..63a7088e9 100644
--- a/tests/test_integration.py
+++ b/tests/test_integration.py
@@ -225,6 +225,26 @@ class TestStaticAppUsingAssetSpec(StaticAppBase, unittest.TestCase):
     package = 'tests.pkgs.static_assetspec'
 
 
+class TestStaticAppUsingAbsPathNulByte(IntegrationBase, unittest.TestCase):
+    package = 'tests.pkgs.static_abspath_nulbyte'
+
+    def test_nulbyte_chroot(self):
+        super_w_null = '..\x00/'
+        self.testapp.get(f'/{super_w_null}', status=404)
+
+
+class TestStaticAppUsingAssetSpecNulByte(IntegrationBase, unittest.TestCase):
+    package = 'tests.pkgs.static_assetspec_nulbyte'
+
+    def test_nulbyte_chroot(self):
+        super_w_null = '..\x00/'
+        self.testapp.get(f'/{super_w_null}', status=404)
+
+    def test_nulbyte_chroot_assetspec_override(self):
+        super_w_null = '..\x00/'
+        self.testapp.get(f'/sub/{super_w_null}', status=404)
+
+
 class TestStaticAppWithEncodings(IntegrationBase, unittest.TestCase):
     package = 'tests.pkgs.static_encodings'