Skip to content
This repository was archived by the owner on Apr 29, 2019. It is now read-only.

Commit a20ee9d

Browse files
committed
MAGETWO-83584: Filesystem write access with path traversal on "static.php"
1 parent 4d62e72 commit a20ee9d

File tree

1 file changed

+3
-6
lines changed

1 file changed

+3
-6
lines changed

lib/internal/Magento/Framework/App/Test/Unit/StaticResourceTest.php

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -290,18 +290,15 @@ public function testCatchExceptionDeveloperMode()
290290
*/
291291
public function testLaunchPathAbove()
292292
{
293+
$path = 'frontend/..\..\folder_above/././Magento_Ui/template/messages.html';
293294
$this->stateMock->expects($this->once())
294295
->method('getMode')
295296
->will($this->returnValue(State::MODE_DEVELOPER));
296297
$this->requestMock->expects($this->once())
297298
->method('get')
298299
->with('resource')
299-
->will(
300-
$this->returnValue(
301-
'frontend/..\..\folder_above'
302-
. '/././Magento_Ui/template/messages.html'
303-
)
304-
);
300+
->willReturn('frontend/..\..\folder_above/././Magento_Ui/template/messages.html');
301+
$this->expectExceptionMessage("Requested path '$path' is wrong.");
305302

306303
$this->object->launch();
307304
}

0 commit comments

Comments
 (0)