diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/file_uploads/tests.py | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/tests/file_uploads/tests.py b/tests/file_uploads/tests.py index 145d714a76..1e20b48d25 100644 --- a/tests/file_uploads/tests.py +++ b/tests/file_uploads/tests.py @@ -283,6 +283,29 @@ class FileUploadTests(TestCase): for i, name in enumerate(filenames): self.assertIsNone(received.get('file%s' % i)) + def test_non_printable_chars_in_file_names(self): + file_name = 'non-\x00printable\x00\n_chars.txt\x00' + payload = client.FakePayload() + payload.write('\r\n'.join([ + '--' + client.BOUNDARY, + f'Content-Disposition: form-data; name="file"; filename="{file_name}"', + 'Content-Type: application/octet-stream', + '', + 'You got pwnd.\r\n' + ])) + payload.write('\r\n--' + client.BOUNDARY + '--\r\n') + r = { + 'CONTENT_LENGTH': len(payload), + 'CONTENT_TYPE': client.MULTIPART_CONTENT, + 'PATH_INFO': '/echo/', + 'REQUEST_METHOD': 'POST', + 'wsgi.input': payload, + } + response = self.client.request(**r) + # Non-printable chars are sanitized. + received = response.json() + self.assertEqual(received['file'], 'non-printable_chars.txt') + def test_dangerous_file_names(self): """Uploaded file names should be sanitized before ever reaching the view.""" # This test simulates possible directory traversal attacks by a |