On May 13, 2010, at 10:43 PM, sdumitriu (SVN) wrote:

Author: sdumitriu Date: 2010-05-13 22:43:41 +0200 (Thu, 13 May 2010) New Revision: 28858

Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/XWiki.java platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SkinAction.java platform/core/trunk/xwiki-core/src/test/java/com/xpn/xwiki/web/SkinActionTest.java Log: XWIKI-2580: Improve file access sandboxing Fixed. Patch from Alex Busenius applied with minor changes.

[snip]

Modified: platform/core/trunk/xwiki-core/src/test/java/com/xpn/xwiki/web/SkinActionTest.java =================================================================== --- platform/core/trunk/xwiki-core/src/test/java/com/xpn/xwiki/web/SkinActionTest.java 2010-05-13 20:24:25 UTC (rev 28857) +++ platform/core/trunk/xwiki-core/src/test/java/com/xpn/xwiki/web/SkinActionTest.java 2010-05-13 20:43:41 UTC (rev 28858) @@ -20,6 +20,8 @@ */ package com.xpn.xwiki.web;

+import java.io.IOException; + import org.jmock.cglib.MockObjectTestCase;

/** @@ -66,4 +68,54 @@ { assertFalse(this.action.isJavascriptMimeType(null)); } + + public void testIncorrectSkinFile() + { + try { + this.action.getSkinFilePath("../../resources/js/xwiki/xwiki.js", "colibri"); + assertTrue("should fail", false);

This should be fail(....)

+ } catch (IOException e) {

This should be "exception" instead of "e" Same below. Note: Using junit4 this should be done using an annotation: @Test(expected=IOException.class) Thanks -Vincent

+ // good + } + try { + this.action.getSkinFilePath("../../../", "colibri"); + assertTrue("should fail", false); + } catch (IOException e) { + // good + } + try { + this.action.getSkinFilePath("resources/js/xwiki/xwiki.js", ".."); + assertTrue("should fail", false); + } catch (IOException e) { + // good + } + try { + this.action.getSkinFilePath("../resources/js/xwiki/xwiki.js", "."); + assertTrue("should fail", false); + } catch (IOException e) { + // good + } + } + + public void testIncorrectResourceFile() + { + try { + this.action.getResourceFilePath("../../skins/js/xwiki/xwiki.js"); + assertTrue("should fail", false); + } catch (IOException e) { + // good + } + try { + this.action.getResourceFilePath("../../../"); + assertTrue("should fail", false); + } catch (IOException e) { + // good + } + try { + this.action.getResourceFilePath("../../redirect"); + assertTrue("should fail", false); + } catch (IOException e) { + // good + } + } }