Skip to content

Commit

Permalink
[2.2.x] Refs CVE-2021-31542 -- Skipped mock AWS storage test on Windows.
Browse files Browse the repository at this point in the history
The validate_file_name() sanitation introduced in
0b79eb3 correctly rejects the example
file name as containing path elements on Windows. This breaks the test
introduced in 914c72b to allow path
components for storages that may allow them.

Test is skipped pending a discussed storage refactoring to support this
use-case.

Backport of a708f39 from main
  • Loading branch information
carltongibson authored and felixxm committed May 6, 2021
1 parent bcafd9b commit 1637003
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions tests/file_storage/test_generate_filename.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
import os
import sys
from unittest import skipIf

from django.core.exceptions import SuspiciousFileOperation
from django.core.files.base import ContentFile
Expand Down Expand Up @@ -93,6 +95,7 @@ def upload_to(instance, filename):
os.path.normpath('some/folder/test_with_space.txt')
)

@skipIf(sys.platform == 'win32', 'Path components in filename are not supported after 0b79eb3.')
def test_filefield_awss3_storage(self):
"""
Simulate a FileField with an S3 storage which uses keys rather than
Expand Down

0 comments on commit 1637003

Please sign in to comment.