path_test.go 1.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253
  1. // Copyright 2018 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package tool
  5. import (
  6. "testing"
  7. . "github.com/smartystreets/goconvey/convey"
  8. )
  9. func Test_IsSameSiteURLPath(t *testing.T) {
  10. Convey("Check if a path belongs to the same site", t, func() {
  11. testCases := []struct {
  12. url string
  13. expect bool
  14. }{
  15. {"//github.com", false},
  16. {"http://github.com", false},
  17. {"https://github.com", false},
  18. {"/\\github.com", false},
  19. {"/admin", true},
  20. {"/user/repo", true},
  21. }
  22. for _, tc := range testCases {
  23. So(IsSameSiteURLPath(tc.url), ShouldEqual, tc.expect)
  24. }
  25. })
  26. }
  27. func Test_IsMaliciousPath(t *testing.T) {
  28. Convey("Detects malicious path", t, func() {
  29. testCases := []struct {
  30. path string
  31. expect bool
  32. }{
  33. {"../../../../../../../../../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true},
  34. {"..\\/..\\/../data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8", true},
  35. {"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", true},
  36. {"..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\gogs\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true},
  37. {"data\\gogs\\..\\..\\..\\..\\..\\..\\..\\..\\..\\data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", true},
  38. {"data/sessions/a/9/a9f0ab6c3ef63dd8", false},
  39. {"data\\sessions\\a\\9\\a9f0ab6c3ef63dd8", false},
  40. }
  41. for _, tc := range testCases {
  42. So(IsMaliciousPath(tc.path), ShouldEqual, tc.expect)
  43. }
  44. })
  45. }
PANIC: session(release): write data/sessions/4/1/41c230acd77e1906: no space left on device

PANIC

session(release): write data/sessions/4/1/41c230acd77e1906: no space left on device
github.com/go-macaron/session@v0.0.0-20190805070824-1a3cdc6f5659/session.go:199 (0x8b2934)
gopkg.in/macaron.v1@v1.3.9/context.go:79 (0x83d0a0)
github.com/go-macaron/inject@v0.0.0-20160627170012-d8a0b8677191/inject.go:157 (0x80ab07)
github.com/go-macaron/inject@v0.0.0-20160627170012-d8a0b8677191/inject.go:135 (0x80a8a8)
gopkg.in/macaron.v1@v1.3.9/context.go:121 (0x83d1f8)
gopkg.in/macaron.v1@v1.3.9/context.go:112 (0x84fdb5)
gopkg.in/macaron.v1@v1.3.9/recovery.go:161 (0x84fda8)
gopkg.in/macaron.v1@v1.3.9/logger.go:40 (0x840c73)
github.com/go-macaron/inject@v0.0.0-20160627170012-d8a0b8677191/inject.go:157 (0x80ab07)
github.com/go-macaron/inject@v0.0.0-20160627170012-d8a0b8677191/inject.go:135 (0x80a8a8)
gopkg.in/macaron.v1@v1.3.9/context.go:121 (0x83d1f8)
gopkg.in/macaron.v1@v1.3.9/router.go:187 (0x850fc6)
gopkg.in/macaron.v1@v1.3.9/router.go:303 (0x8493e5)
gopkg.in/macaron.v1@v1.3.9/macaron.go:220 (0x841fca)
net/http/server.go:2836 (0x7a79b2)
net/http/server.go:1924 (0x7a341b)
runtime/asm_amd64.s:1373 (0x46f9f0)