check status code when restricted; fix formatting
mod fixtures;
-use std::fs::create_dir_all;
use assert_fs::fixture::TempDir;
use fixtures::{server, server_no_stderr, tmpdir, Error, TestServer};
use reqwest::blocking::{multipart, Client};
use rstest::rstest;
use select::document::Document;
use select::predicate::{Attr, Text};
+use std::fs::create_dir_all;
#[rstest]
fn uploading_files_works(#[with(&["-u"])] server: TestServer) -> Result<(), Error> {
@@ -86,9 +86,7 @@ fn uploading_files_is_prevented(server: TestServer) -> Result<(), Error> {
#[rstest]
#[case(server_no_stderr(&["-u", "--allowed-upload-dir", "someDir"]))]
#[case(server_no_stderr(&["-u", "--allowed-upload-dir", "someDir/some_sub_dir"]))]
-fn uploading_files_is_restricted(
- #[case] server: TestServer
-) -> Result<(), Error> {
+fn uploading_files_is_restricted(#[case] server: TestServer) -> Result<(), Error> {
let test_file_name = "uploaded test file.txt";
// Then try to upload file to root directory (which is not the --allowed-upload-dir)
@@ -100,12 +98,14 @@ fn uploading_files_is_restricted(
let client = Client::new();
// Ensure uploading fails and returns an error
- assert!(client
+ assert_eq!(
+ 500,
+ client
.post(server.url().join("/upload?path=/")?)
.multipart(form)
.send()?
- .error_for_status()
- .is_err());
+ .status()
+ );
// After uploading, check whether the uploaded file is NOT getting listed.
let body = reqwest::blocking::get(server.url())?;
@@ -160,12 +160,10 @@ fn uploading_files_to_allowed_dir_works(
let body = reqwest::blocking::get(server.url().join(upload_dir)?)?;
let parsed = Document::from_read(body)?;
assert!(parsed.find(Text).any(|x| x.text() == test_file_name));
-
}
Ok(())
}
-
/// Test for path traversal vulnerability (CWE-22) in both path parameter of query string and in
/// file name (Content-Disposition)
///
