From b8ba73cd0cb6a3dbdaeb3df65936970956829de3 Mon Sep 17 00:00:00 2001 From: Aymeric Augustin Date: Tue, 11 Nov 2014 18:59:49 +0100 Subject: Raised SuspiciousFileOperation in safe_join. Added a test for the condition safe_join is designed to prevent. Previously, a generic ValueError was raised. It was impossible to tell an intentional exception raised to implement safe_join's contract from an unintentional exception caused by incorrect inputs or unexpected conditions. That resulted in bizarre exception catching patterns, which this patch removes. Since safe_join is a private API and since the change is unlikely to create security issues for users who use it anyway -- at worst, an uncaught SuspiciousFileOperation exception will bubble up -- it isn't documented. --- tests/utils_tests/test_os_utils.py | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'tests/utils_tests') diff --git a/tests/utils_tests/test_os_utils.py b/tests/utils_tests/test_os_utils.py index da54e93ac0..7e6c74b3da 100644 --- a/tests/utils_tests/test_os_utils.py +++ b/tests/utils_tests/test_os_utils.py @@ -1,6 +1,7 @@ import os import unittest +from django.core.exceptions import SuspiciousFileOperation from django.utils._os import safe_join @@ -24,3 +25,7 @@ class SafeJoinTests(unittest.TestCase): path, os.path.sep, ) + + def test_parent_path(self): + with self.assertRaises(SuspiciousFileOperation): + safe_join("/abc/", "../def") -- cgit v1.3