From ae905a8f35e7e997eebc78f4e92cc3e6871a9532 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= Date: Mon, 16 Oct 2023 17:50:28 +0200 Subject: [PATCH] test: fix defect path traversal tests The test never actually tested what it claims to test because it did not properly insert separators before `..`. PR-URL: https://github.com/nodejs/node/pull/50124 Reviewed-By: Yagiz Nizipli Reviewed-By: Rafael Gonzaga --- test/fixtures/permission/fs-traversal.js | 6 +++--- test/parallel/test-permission-fs-traversal-path.js | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/fixtures/permission/fs-traversal.js b/test/fixtures/permission/fs-traversal.js index 18243edfeadf7e..87132177643c45 100644 --- a/test/fixtures/permission/fs-traversal.js +++ b/test/fixtures/permission/fs-traversal.js @@ -12,9 +12,9 @@ path.resolve = (s) => s; const blockedFolder = process.env.BLOCKEDFOLDER; const allowedFolder = process.env.ALLOWEDFOLDER; -const traversalPath = allowedFolder + '../file.md'; -const traversalFolderPath = allowedFolder + '../folder'; -const bufferTraversalPath = Buffer.from(allowedFolder + '../file.md'); +const traversalPath = allowedFolder + '/../file.md'; +const traversalFolderPath = allowedFolder + '/../folder'; +const bufferTraversalPath = Buffer.from(traversalPath); const uint8ArrayTraversalPath = new TextEncoder().encode(traversalPath); { diff --git a/test/parallel/test-permission-fs-traversal-path.js b/test/parallel/test-permission-fs-traversal-path.js index 547cd81c77cf18..d618c3e4f79879 100644 --- a/test/parallel/test-permission-fs-traversal-path.js +++ b/test/parallel/test-permission-fs-traversal-path.js @@ -18,7 +18,7 @@ const tmpdir = require('../common/tmpdir'); const file = fixtures.path('permission', 'fs-traversal.js'); const blockedFolder = tmpdir.path; -const allowedFolder = tmpdir.resolve('subdirectory/'); +const allowedFolder = tmpdir.resolve('subdirectory'); const commonPathWildcard = path.join(__filename, '../../common*'); {