24 lines
874 B
Python
24 lines
874 B
Python
|
import tempfile
|
||
|
|
import unittest
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from archive import extract_entries
|
||
|
|
|
||
|
|
|
||
|
|
class HoldoutArchiveTests(unittest.TestCase):
|
||
|
|
def test_absolute_member_is_rejected(self):
|
||
|
|
with tempfile.TemporaryDirectory() as temporary:
|
||
|
|
with self.assertRaises(ValueError):
|
||
|
|
extract_entries([("/tmp/mmo-forbidden", b"bad")], temporary)
|
||
|
|
|
||
|
|
def test_nested_parent_escape_is_rejected(self):
|
||
|
|
with tempfile.TemporaryDirectory() as temporary:
|
||
|
|
outside = Path(temporary).parent / "mmo-hidden-escape"
|
||
|
|
outside.unlink(missing_ok=True)
|
||
|
|
try:
|
||
|
|
with self.assertRaises(ValueError):
|
||
|
|
extract_entries([("safe/../../mmo-hidden-escape", b"bad")], temporary)
|
||
|
|
self.assertFalse(outside.exists())
|
||
|
|
finally:
|
||
|
|
outside.unlink(missing_ok=True)
|