Merge pull request #375 from ender672/test_unsafe_dir_traversal

Actually test unsafe directory traversal
rack · May 13, 2012 · f5986af · f5986af
2 parents 9fffbfd + 1eaf4e8
commit f5986af
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/test/spec_file.rb b/test/spec_file.rb
@@ -65,13 +65,13 @@ def file(*args)
   should "not allow unsafe directory traversal" do
     req = Rack::MockRequest.new(file(DOCROOT))
 
-    res = req.get("/../README")
+    res = req.get("/../README.rdoc")
     res.should.be.client_error
 
-    res = req.get("../test")
+    res = req.get("../test/spec_file.rb")
     res.should.be.client_error
 
-    res = req.get("..")
+    res = req.get("../README.rdoc")
     res.should.be.client_error
 
     res.should.be.not_found