lp:~jderose/degu/dotdot

Branch merges

Propose for merging

No branches dependent on this one.

Merged into lp:degu at revision 479

David Jordan: Approve on 2019-12-19

Diff: 152 lines (+75/-1)

5 files modified

degu/_base.c (+5/-0)
degu/_basepy.py (+2/-0)
degu/tests/helpers.py (+1/-1)
degu/tests/test_base.py (+48/-0)
doc/changelog.rst (+19/-0)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #1856935: Server should disallow '..' in request path components

High

Fix Committed

Link a bug report

Related blueprints

485. By Jason Gerard DeRose on 2019-12-19

Whitespace cleanup

484. By Jason Gerard DeRose on 2019-12-19

Note new behavior in changelog.rst

483. By Jason Gerard DeRose on 2019-12-19

Futher expand test cases

482. By Jason Gerard DeRose on 2019-12-19

Tweak '..' error message a bit

481. By Jason Gerard DeRose on 2019-12-19

Python impl. now also disallows '..' in path components

480. By Jason Gerard DeRose on 2019-12-19

C impl. now disallows '..' in path components

479. By Jason Gerard DeRose on 2019-12-18

Add more to parse_uri(), parse_request() tests to confirm current behavior

478. By Jason Gerard DeRose on 2019-12-18

For now disable live FilesApp tests till I figure out why it's failing on the Ubuntu build servers

477. By Jason Gerard DeRose on 2019-12-18

FilesApp.__init__() now ensures dir_name is an absolute, normalized path

476. By Jason Gerard DeRose on 2019-12-18

Oops, that new FilesApp totally allowed directory traversal attacks, so fix that, yup