From b9a6179c1dbdc16860099bfb8831bf1f3d0f39a2 Mon Sep 17 00:00:00 2001 From: Wojtek Kosior Date: Thu, 24 Mar 2022 21:30:20 +0100 Subject: fix payload creation for file:// URLs --- common/patterns.js | 2 +- test/haketilo_test/unit/test_patterns.py | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/common/patterns.js b/common/patterns.js index 9e9d387..7381cdd 100644 --- a/common/patterns.js +++ b/common/patterns.js @@ -192,7 +192,7 @@ const patterns_doc_url = function reconstruct_url(deco) { - const domain = deco.domain.join("."); + const domain = (deco.domain || []).join("."); const path = ["", ...deco.path].join("/"); const trail = deco.trailing_slash ? "/" : ""; return `${deco.proto}://${domain}${path}${trail}`; diff --git a/test/haketilo_test/unit/test_patterns.py b/test/haketilo_test/unit/test_patterns.py index f2eeaf8..2ba4dce 100644 --- a/test/haketilo_test/unit/test_patterns.py +++ b/test/haketilo_test/unit/test_patterns.py @@ -103,6 +103,9 @@ def test_deconstruct_url(execute_in_page): assert deco['domain'] == ['example', 'com'] assert deco['path'] == ['a', 'b'] + reco = execute_in_page('returnval(reconstruct_url(arguments[0]));', deco) + assert reco == 'https://example.com/a/b' + deco = execute_in_page('returnval(deconstruct_url(arguments[0]));', 'http://**.example.com/') assert deco @@ -111,6 +114,9 @@ def test_deconstruct_url(execute_in_page): assert deco['domain'] == ['**', 'example', 'com'] assert deco['path'] == [] + reco = execute_in_page('returnval(reconstruct_url(arguments[0]));', deco) + assert reco == 'http://**.example.com/' + deco = execute_in_page('returnval(deconstruct_url(arguments[0]));', 'ftp://user@ftp.example.com/all///passwords.txt/') assert deco @@ -119,6 +125,9 @@ def test_deconstruct_url(execute_in_page): assert deco['domain'] == ['ftp', 'example', 'com'] assert deco['path'] == ['all', 'passwords.txt'] + reco = execute_in_page('returnval(reconstruct_url(arguments[0]));', deco) + assert reco == 'ftp://ftp.example.com/all/passwords.txt/' + deco = execute_in_page('returnval(deconstruct_url(arguments[0]));', 'ftp://mirror.edu.pl.eu.org') assert deco @@ -127,6 +136,9 @@ def test_deconstruct_url(execute_in_page): assert deco['domain'] == ['mirror', 'edu', 'pl', 'eu', 'org'] assert deco['path'] == [] + reco = execute_in_page('returnval(reconstruct_url(arguments[0]));', deco) + assert reco == 'ftp://mirror.edu.pl.eu.org' + deco = execute_in_page('returnval(deconstruct_url(arguments[0]));', 'file:///mnt/parabola_chroot///etc/passwd') assert deco @@ -135,6 +147,9 @@ def test_deconstruct_url(execute_in_page): assert deco['path'] == ['mnt', 'parabola_chroot', 'etc', 'passwd'] assert 'domain' not in deco + reco = execute_in_page('returnval(reconstruct_url(arguments[0]));', deco) + assert reco == 'file:///mnt/parabola_chroot/etc/passwd' + for bad_url in [ '://bad-url.missing/protocol', 'http:/example.com/a/b', -- cgit v1.2.3