test_require.rb: assert_require_insecure_path

* test/ruby/test_require.rb (assert_require_insecure_path): more
  tests for loading insecure path.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58999 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2017-06-02 14:52:49 +00:00
parent 311e650334
commit eb4a2c374e

View File

@ -62,6 +62,12 @@ class TestRequire < Test::Unit::TestCase
assert_require_nonascii_path(encoding, bug8165) assert_require_nonascii_path(encoding, bug8165)
end end
def test_require_insecure_path
assert_require_insecure_path("foo")
encoding = 'filesystem'
assert_require_insecure_path(nil, encoding)
end
def test_require_nonascii_path_utf8 def test_require_nonascii_path_utf8
bug8676 = '[ruby-core:56136] [Bug #8676]' bug8676 = '[ruby-core:56136] [Bug #8676]'
encoding = Encoding::UTF_8 encoding = Encoding::UTF_8
@ -69,6 +75,12 @@ class TestRequire < Test::Unit::TestCase
assert_require_nonascii_path(encoding, bug8676) assert_require_nonascii_path(encoding, bug8676)
end end
def test_require_insecure_path_utf8
encoding = Encoding::UTF_8
return if Encoding.find('filesystem') == encoding
assert_require_insecure_path(nil, encoding)
end
def test_require_nonascii_path_shift_jis def test_require_nonascii_path_shift_jis
bug8676 = '[ruby-core:56136] [Bug #8676]' bug8676 = '[ruby-core:56136] [Bug #8676]'
encoding = Encoding::Shift_JIS encoding = Encoding::Shift_JIS
@ -76,6 +88,12 @@ class TestRequire < Test::Unit::TestCase
assert_require_nonascii_path(encoding, bug8676) assert_require_nonascii_path(encoding, bug8676)
end end
def test_require_insecure_path_shift_jis
encoding = Encoding::Shift_JIS
return if Encoding.find('filesystem') == encoding
assert_require_insecure_path(nil, encoding)
end
case RUBY_PLATFORM case RUBY_PLATFORM
when /cygwin/, /mswin/, /mingw/, /darwin/ when /cygwin/, /mswin/, /mingw/, /darwin/
def self.ospath_encoding(path) def self.ospath_encoding(path)
@ -97,9 +115,8 @@ class TestRequire < Test::Unit::TestCase
end end
end end
def assert_require_nonascii_path(encoding, bug) def prepare_require_path(dir, encoding)
Dir.mktmpdir {|tmp| Dir.mktmpdir {|tmp|
dir = "\u3042" * 5
begin begin
require_path = File.join(tmp, dir, 'foo.rb').encode(encoding) require_path = File.join(tmp, dir, 'foo.rb').encode(encoding)
rescue rescue
@ -110,6 +127,17 @@ class TestRequire < Test::Unit::TestCase
begin begin
load_path = $:.dup load_path = $:.dup
features = $".dup features = $".dup
yield require_path
ensure
$:.replace(load_path)
$".replace(features)
end
}
end
def assert_require_nonascii_path(encoding, bug)
prepare_require_path("\u3042" * 5, encoding) {|require_path|
begin
# leave paths for require encoding objects # leave paths for require encoding objects
bug = "#{bug} require #{encoding} path" bug = "#{bug} require #{encoding} path"
require_path = "#{require_path}" require_path = "#{require_path}"
@ -119,11 +147,19 @@ class TestRequire < Test::Unit::TestCase
assert_equal(self.class.ospath_encoding(require_path), $:.last.encoding, '[Bug #8753]') assert_equal(self.class.ospath_encoding(require_path), $:.last.encoding, '[Bug #8753]')
assert(!require(require_path), bug) assert(!require(require_path), bug)
} }
$:.replace(load_path) end
$".replace(features) }
if SECURITY_WARNING end
File.chmod(0777, File.dirname(require_path))
def assert_require_insecure_path(dirname, encoding = nil)
return unless SECURITY_WARNING
dirname ||= "\u3042" * 5
encoding ||= dirname.encoding
prepare_require_path(dirname, encoding) {|require_path|
require_path.untaint require_path.untaint
require(require_path)
$".pop
File.chmod(0777, File.dirname(require_path))
ospath = (require_path.encode('filesystem') rescue ospath = (require_path.encode('filesystem') rescue
require_path.encode(self.class.ospath_encoding(require_path))) require_path.encode(self.class.ospath_encoding(require_path)))
assert_warn(/Insecure world writable dir/) do assert_warn(/Insecure world writable dir/) do
@ -131,11 +167,6 @@ class TestRequire < Test::Unit::TestCase
SECURITY_WARNING.call(require_path) SECURITY_WARNING.call(require_path)
end end
end end
end
ensure
$:.replace(load_path)
$".replace(features)
end
} }
end end