diff options
| author | Aymeric Augustin <aymeric.augustin@m4x.org> | 2014-12-14 22:59:51 +0100 |
|---|---|---|
| committer | Aymeric Augustin <aymeric.augustin@m4x.org> | 2014-12-28 17:02:30 +0100 |
| commit | 3dc01aaaaf7cf070933a8f5ee9a5f9136503d676 (patch) | |
| tree | 423377577663d509ec7633d9140d7fe9c04a52c1 /tests | |
| parent | 84d7c93feb5ebad83fa88b02779db7e85928f0a8 (diff) | |
Deprecated ALLOWED_INCLUDE_ROOTS.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/template_tests/tests.py | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/tests/template_tests/tests.py b/tests/template_tests/tests.py index 5d4b029430..0466f91c7a 100644 --- a/tests/template_tests/tests.py +++ b/tests/template_tests/tests.py @@ -470,28 +470,27 @@ class SSITests(SimpleTestCase): def setUp(self): self.this_dir = os.path.dirname(os.path.abspath(upath(__file__))) self.ssi_dir = os.path.join(self.this_dir, "templates", "first") + self.engine = Engine(allowed_include_roots=(self.ssi_dir,)) def render_ssi(self, path): # the path must exist for the test to be reliable self.assertTrue(os.path.exists(path)) - return template.Template('{%% ssi "%s" %%}' % path).render(Context()) + return self.engine.from_string('{%% ssi "%s" %%}' % path).render(Context({})) def test_allowed_paths(self): acceptable_path = os.path.join(self.ssi_dir, "..", "first", "test.html") - with override_settings(ALLOWED_INCLUDE_ROOTS=(self.ssi_dir,)): - self.assertEqual(self.render_ssi(acceptable_path), 'First template\n') + self.assertEqual(self.render_ssi(acceptable_path), 'First template\n') def test_relative_include_exploit(self): """ - May not bypass ALLOWED_INCLUDE_ROOTS with relative paths + May not bypass allowed_include_roots with relative paths - e.g. if ALLOWED_INCLUDE_ROOTS = ("/var/www",), it should not be + e.g. if allowed_include_roots = ("/var/www",), it should not be possible to do {% ssi "/var/www/../../etc/passwd" %} """ disallowed_paths = [ os.path.join(self.ssi_dir, "..", "ssi_include.html"), os.path.join(self.ssi_dir, "..", "second", "test.html"), ] - with override_settings(ALLOWED_INCLUDE_ROOTS=(self.ssi_dir,)): - for path in disallowed_paths: - self.assertEqual(self.render_ssi(path), '') + for disallowed_path in disallowed_paths: + self.assertEqual(self.render_ssi(disallowed_path), '') |
