[3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads.

1 files changed, 8 insertions, 0 deletions

diff --git a/tests/utils_tests/test_text.py b/tests/utils_tests/test_text.py
index 1b6bfc0b8e..d2a94fcdab 100644
--- a/tests/utils_tests/test_text.py
+++ b/tests/utils_tests/test_text.py
@@ -1,6 +1,7 @@
 import json
 import sys
 
+from django.core.exceptions import SuspiciousFileOperation
 from django.test import SimpleTestCase, ignore_warnings
 from django.utils import text
 from django.utils.deprecation import RemovedInDjango40Warning
@@ -255,6 +256,13 @@ class TestUtilsText(SimpleTestCase):
         filename = "^&'@{}[],$=!-#()%+~_123.txt"
         self.assertEqual(text.get_valid_filename(filename), "-_123.txt")
         self.assertEqual(text.get_valid_filename(lazystr(filename)), "-_123.txt")
+        msg = "Could not derive file name from '???'"
+        with self.assertRaisesMessage(SuspiciousFileOperation, msg):
+            text.get_valid_filename('???')
+        # After sanitizing this would yield '..'.
+        msg = "Could not derive file name from '$.$.$'"
+        with self.assertRaisesMessage(SuspiciousFileOperation, msg):
+            text.get_valid_filename('$.$.$')
 
     def test_compress_sequence(self):
         data = [{'key': i} for i in range(10)]