Merge branch 'tseaver-jp_exploit_fix'

5 files changed, 47 insertions, 0 deletions

diff --git a/tests/fixtures/index.html b/tests/fixtures/index.html
new file mode 100644
index 000000000..a37df5790
--- /dev/null
+++ b/tests/fixtures/index.html
@@ -0,0 +1 @@
+<h1>DON'T GO HERE</h1>
diff --git a/tests/pkgs/static_abspath_nulbyte/__init__.py b/tests/pkgs/static_abspath_nulbyte/__init__.py
new file mode 100644
index 000000000..2248522e9
--- /dev/null
+++ b/tests/pkgs/static_abspath_nulbyte/__init__.py
@@ -0,0 +1,9 @@
+import os
+
+
+def includeme(config):
+    here = here = os.path.dirname(__file__)
+    static = os.path.normpath(
+        os.path.join(here, '..', '..', 'fixtures', 'static')
+    )
+    config.add_static_view('/', static)
diff --git a/tests/pkgs/static_assetspec_nulbyte/__init__.py b/tests/pkgs/static_assetspec_nulbyte/__init__.py
new file mode 100644
index 000000000..d44b04e93
--- /dev/null
+++ b/tests/pkgs/static_assetspec_nulbyte/__init__.py
@@ -0,0 +1,6 @@
+def includeme(config):
+    config.add_static_view('/', 'tests:fixtures/static')
+    config.add_static_view('/sub', 'tests:fixtures/static/subdir')
+    config.override_asset(
+        'tests:fixtures/static/subdir', 'tests:fixtures/static'
+    )
diff --git a/tests/test_integration.py b/tests/test_integration.py
index 0b55872d2..63a7088e9 100644
--- a/tests/test_integration.py
+++ b/tests/test_integration.py
@@ -225,6 +225,26 @@ class TestStaticAppUsingAssetSpec(StaticAppBase, unittest.TestCase):
     package = 'tests.pkgs.static_assetspec'
 
 
+class TestStaticAppUsingAbsPathNulByte(IntegrationBase, unittest.TestCase):
+    package = 'tests.pkgs.static_abspath_nulbyte'
+
+    def test_nulbyte_chroot(self):
+        super_w_null = '..\x00/'
+        self.testapp.get(f'/{super_w_null}', status=404)
+
+
+class TestStaticAppUsingAssetSpecNulByte(IntegrationBase, unittest.TestCase):
+    package = 'tests.pkgs.static_assetspec_nulbyte'
+
+    def test_nulbyte_chroot(self):
+        super_w_null = '..\x00/'
+        self.testapp.get(f'/{super_w_null}', status=404)
+
+    def test_nulbyte_chroot_assetspec_override(self):
+        super_w_null = '..\x00/'
+        self.testapp.get(f'/sub/{super_w_null}', status=404)
+
+
 class TestStaticAppWithEncodings(IntegrationBase, unittest.TestCase):
     package = 'tests.pkgs.static_encodings'
 
diff --git a/tests/test_static.py b/tests/test_static.py
index af487fa24..5b11d89a8 100644
--- a/tests/test_static.py
+++ b/tests/test_static.py
@@ -104,6 +104,17 @@ class Test_static_view_use_subpath_False(unittest.TestCase):
 
         self.assertRaises(HTTPNotFound, inst, context, request)
 
+    def test_oob_nul_char(self):
+        import os
+
+        inst = self._makeOne(f'{os.getcwd()}/tests/fixtures/static')
+        super_w_null = '..\x00/'
+        request = self._makeRequest({'PATH_INFO': f'/{super_w_null}'})
+        context = DummyContext()
+        from pyramid.httpexceptions import HTTPNotFound
+
+        self.assertRaises(HTTPNotFound, inst, context, request)
+
     def test_resource_doesnt_exist(self):
         inst = self._makeOne('tests:fixtures/static')
         request = self._makeRequest({'PATH_INFO': '/notthere'})