]> git.ipfire.org Git - thirdparty/tornado.git/commitdiff
Force simple_httpclient in path traversal test.
authorBen Darnell <ben@bendarnell.com>
Sat, 3 Oct 2015 15:40:22 +0000 (11:40 -0400)
committerBen Darnell <ben@bendarnell.com>
Sat, 3 Oct 2015 15:40:22 +0000 (11:40 -0400)
This fails with recent versions of libcurl because curl now processes
".." on the client side.

tornado/test/web_test.py

index f04db9597e7fcad0b6ed556714b9375de938774e..561bad3e5c6211abd44701f6ae0fe408d946fdc3 100644 (file)
@@ -1197,6 +1197,10 @@ class StaticFileTest(WebTestCase):
         self.assertEqual(response.code, 404)
 
     def test_path_traversal_protection(self):
+        # curl_httpclient processes ".." on the client side, so we
+        # must test this with simple_httpclient.
+        self.http_client.close()
+        self.http_client = SimpleAsyncHTTPClient()
         with ExpectLog(gen_log, ".*not in root static directory"):
             response = self.get_and_head('/static/../static_foo.txt')
         # Attempted path traversal should result in 403, not 200