[3.2.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem.

Thanks to Dennis Brinkrolf for the report.

1 files changed, 6 insertions, 0 deletions

diff --git a/tests/file_storage/tests.py b/tests/file_storage/tests.py
index 6d17a7118b..7238093244 100644
--- a/tests/file_storage/tests.py
+++ b/tests/file_storage/tests.py
@@ -297,6 +297,12 @@ class FileStorageTests(SimpleTestCase):
 
         self.storage.delete('path/to/test.file')
 
+    def test_file_save_abs_path(self):
+        test_name = 'path/to/test.file'
+        f = ContentFile('file saved with path')
+        f_name = self.storage.save(os.path.join(self.temp_dir, test_name), f)
+        self.assertEqual(f_name, test_name)
+
     def test_save_doesnt_close(self):
         with TemporaryUploadedFile('test', 'text/plain', 1, 'utf8') as file:
             file.write(b'1')