22from pathlib import Path , PurePath
33from unittest .mock import patch
44import aikido_zen
5+ import aikido_zen .test_utils as test_utils
56
67aikido_zen .protect ()
78from aikido_zen .context import Context
1011kind = "path_traversal"
1112
1213
13- def set_context (param ):
14- wsgi_request = {
15- "REQUEST_METHOD" : "GET" ,
16- "HTTP_HEADER_1" : "header 1 value" ,
17- "HTTP_HEADER_2" : "Header 2 value" ,
18- "RANDOM_VALUE" : "Random value" ,
19- "HTTP_COOKIE" : "sessionId=abc123xyz456;" ,
20- "wsgi.url_scheme" : "http" ,
21- "HTTP_HOST" : "localhost:8080" ,
22- "PATH_INFO" : "/hello" ,
23- "QUERY_STRING" : "user=JohnDoe&age=30&age=35" ,
24- "CONTENT_TYPE" : "application/json" ,
25- "REMOTE_ADDR" : "198.51.100.23" ,
26- }
27- context = Context (
28- req = wsgi_request ,
29- body = {
30- "param" : param ,
31- },
32- source = "flask" ,
33- )
34- context .set_as_current_context ()
35-
36-
3714@pytest .fixture (autouse = True )
3815def set_blocking_to_true (monkeypatch ):
3916 monkeypatch .setenv ("AIKIDO_BLOCK" , "1" )
@@ -76,7 +53,7 @@ def test_os_create_path_with_multiple_slashes():
7653 import os
7754
7855 file_path = "////etc/passwd"
79- set_context (file_path )
56+ test_utils . generate_and_set_context (file_path )
8057 with pytest .raises (AikidoPathTraversal ):
8158 full_path = Path ("flaskr/resources/blogs/" ) / file_path
8259 open (full_path , "r" ).close ()
@@ -86,7 +63,7 @@ def test_os_create_path_with_multiple_double_slashes():
8663 import os
8764
8865 file_path = "////etc//passwd"
89- set_context (file_path )
66+ test_utils . generate_and_set_context (file_path )
9067 with pytest .raises (AikidoPathTraversal ):
9168 full_path = Path ("flaskr/resources/blogs/" ) / file_path
9269 open (full_path , "r" ).close ()
@@ -96,7 +73,7 @@ def test_os_path_traversal_with_multiple_slashes():
9673 import os
9774
9875 file_path = "home///..////..////my_secret.txt"
99- set_context (file_path )
76+ test_utils . generate_and_set_context (file_path )
10077 with pytest .raises (AikidoPathTraversal ):
10178 full_path = Path ("flaskr/resources/blogs/" ) / file_path
10279 open (full_path , "r" ).close ()
0 commit comments