This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch db/8607
in repository https://gitbox.apache.org/repos/asf/allura.git
The following commit(s) were added to refs/heads/db/8607 by this push:
new 356de29c4 fixup! [#8607] test for save_attachments (export) path
handling
356de29c4 is described below
commit 356de29c462537b0639fdbb4fd924bbb6702c5ec
Author: Dave Brondsema <[email protected]>
AuthorDate: Wed May 27 12:11:46 2026 -0400
fixup! [#8607] test for save_attachments (export) path handling
---
Allura/allura/tests/test_app.py | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/Allura/allura/tests/test_app.py b/Allura/allura/tests/test_app.py
index adf41bf5c..6b3b73d03 100644
--- a/Allura/allura/tests/test_app.py
+++ b/Allura/allura/tests/test_app.py
@@ -188,16 +188,16 @@ def rfile(self):
return BytesIO(self._data)
# Test with a malicious filename containing path traversal
- malicious_name = '../../../etc/passwd'
+ malicious_name = '../../allura-test-case/foobar'
attachments = [FakeAttachment(malicious_name, b'evil data')]
a.save_attachments(export_dir, attachments)
# The file should be written as a basename, not traverse directories
- expected_file = os.path.join(export_dir, 'passwd')
+ expected_file = os.path.join(export_dir, 'foobar')
assert os.path.exists(expected_file)
# Verify the traversal path was NOT created
- traversal_path = os.path.join(export_dir, '..', '..', '..', 'etc')
+ traversal_path = os.path.join(export_dir, '..', '..',
'allura-test-case', 'foobar')
assert not os.path.exists(traversal_path)
# Verify file contents
