Alessandro RosandGitHub
7418e51031
Path names are used as part of paths in several components: in the recorder, in the playback server and in every HTTP-based component (WebRTC, HLS, API). Special characters that allow to escape from the intended directory are now forbidden in order to prevent directory traversal attacks.
62 lines
1.2 KiB
Go
62 lines
1.2 KiB
Go
package conf
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/bluenviron/gortsplib/v5"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestPathClone(t *testing.T) {
|
|
original := &Path{
|
|
Name: "example",
|
|
RTSPTransport: RTSPTransport{ptrOf(gortsplib.ProtocolUDP)},
|
|
SourceAnyPortEnable: ptrOf(true),
|
|
RecordPath: "/var/recordings",
|
|
}
|
|
|
|
clone := original.Clone()
|
|
require.Equal(t, original, clone)
|
|
}
|
|
|
|
func TestIsValidPathName(t *testing.T) {
|
|
for _, ca := range []struct {
|
|
name string
|
|
path string
|
|
errMsg string
|
|
}{
|
|
{
|
|
name: "valid nested path",
|
|
path: "group/cam1",
|
|
},
|
|
{
|
|
name: "valid dots inside segment",
|
|
path: "cam.v1/main",
|
|
},
|
|
{
|
|
name: "parent directory",
|
|
path: "../cam1",
|
|
errMsg: "can't contain dot path segments",
|
|
},
|
|
{
|
|
name: "embedded parent directory",
|
|
path: "group/../cam1",
|
|
errMsg: "can't contain dot path segments",
|
|
},
|
|
{
|
|
name: "current directory",
|
|
path: "./cam1",
|
|
errMsg: "can't contain dot path segments",
|
|
},
|
|
} {
|
|
t.Run(ca.name, func(t *testing.T) {
|
|
err := IsValidPathName(ca.path)
|
|
if ca.errMsg != "" {
|
|
require.EqualError(t, err, ca.errMsg)
|
|
} else {
|
|
require.NoError(t, err)
|
|
}
|
|
})
|
|
}
|
|
}
|