diff options
Diffstat (limited to 'tests/test_server.py')
| -rw-r--r-- | tests/test_server.py | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/tests/test_server.py b/tests/test_server.py index 3340398..1e942c2 100644 --- a/tests/test_server.py +++ b/tests/test_server.py @@ -91,6 +91,20 @@ class Server(unittest.TestCase): h = {**HOST, **ORIGIN, "Content-Type": "application/json"} self.assertEqual(self.req("POST", "/api/demo/boom", h, '{"x": null}')[0], 400) + def test_icons_route_rejects_traversal(self): + self.assertEqual(self.req("GET", "/icons/..%2Fconfig.toml", HOST)[0], 404) + + def test_icon_path_resolves_and_rejects(self): + import tempfile + from pathlib import Path + base = Path(tempfile.mkdtemp()) + d = base / "candy-icons" / "apps" / "scalable" + d.mkdir(parents=True) + (d / "obs.svg").write_text("<svg/>") + self.assertEqual(srv.icon_path("obs", "candy-icons", [base]), d / "obs.svg") + self.assertIsNone(srv.icon_path("../x", "candy-icons", [base])) + self.assertIsNone(srv.icon_path("nope", "candy-icons", [base])) + def test_art_route(self): from unittest import mock with mock.patch.object(srv, "art", return_value=(b"PNGDATA", "image/png")): |