mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add integration tests for transferring files of a user with a risky name 

The files:transfer-ownership performs a sanitization of users with
"risky" display names (including characters like "\" or "/").

In order to allow (escaped) double quotes in the display name the
regular expression used in the "user XXX with displayname YYY exists"
step had to be adjusted.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
This commit is contained in:
Daniel Calviño Sánchez 2020-09-18 18:32:59 +02:00 committed by backportbot[bot]
parent 87b9dbdb56
commit bf9a24efbe
3 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
build/integration/features/bootstrap/CommandLineContext.php
View File

@ -27,6 +27,7 @@
require __DIR__ . '/../../vendor/autoload.php'; require __DIR__ . '/../../vendor/autoload.php';
use Behat\Behat\Hook\Scope\BeforeScenarioScope; use Behat\Behat\Hook\Scope\BeforeScenarioScope;
use PHPUnit\Framework\Assert;
class CommandLineContext implements \Behat\Behat\Context\Context { class CommandLineContext implements \Behat\Behat\Context\Context {
use CommandLine; use CommandLine;
@ -129,4 +130,11 @@ class CommandLineContext implements \Behat\Behat\Context\Context {
$davPath = rtrim($davPath, '/') . $this->lastTransferPath; $davPath = rtrim($davPath, '/') . $this->lastTransferPath;
$this->featureContext->usingDavPath($davPath); $this->featureContext->usingDavPath($davPath);
} }
/**
* @Then /^transfer folder name contains "([^"]+)"$/
*/
public function transferFolderNameContains($text) {
Assert::assertContains($text, $this->lastTransferPath);
}
} }

2
build/integration/features/bootstrap/Provisioning.php
View File

@ -70,7 +70,7 @@ trait Provisioning {
} }
/** /**
* @Given /^user "([^"]*)" with displayname "([^"]*)" exists$/ * @Given /^user "([^"]*)" with displayname "((?:[^"]|\\")*)" exists$/
* @param string $user * @param string $user
*/ */
public function assureUserWithDisplaynameExists($user, $displayname) { public function assureUserWithDisplaynameExists($user, $displayname) {

32
build/integration/features/transfer-ownership.feature
View File

@ -29,6 +29,22 @@ Feature: transfer-ownership
And using received transfer folder of "user1" as dav path And using received transfer folder of "user1" as dav path
And as "user1" the folder "/test" exists And as "user1" the folder "/test" exists
Scenario: transferring ownership from user with risky display name
Given user "user0" with displayname "user0 \"risky\"? ヂspḷay 'na|\/|e':.#" exists
And user "user1" exists
And User "user0" created a folder "/test"
And User "user0" uploads file "data/textfile.txt" to "/test/somefile.txt"
When transferring ownership from "user0" to "user1"
And the command was successful
And As an "user1"
And using received transfer folder of "user1" as dav path
Then Downloaded content when downloading file "/test/somefile.txt" with range "bytes=0-6" should be "This is"
And transfer folder name contains "transferred from user0 -risky- ヂspḷay -na|-|e- on"
And using old dav path
And as "user0" the folder "/test" does not exist
And using received transfer folder of "user1" as dav path
And as "user1" the folder "/test" exists
Scenario: transferring ownership of file shares Scenario: transferring ownership of file shares
Given user "user0" exists Given user "user0" exists
And user "user1" exists And user "user1" exists
@ -319,6 +335,22 @@ Feature: transfer-ownership
And using received transfer folder of "user1" as dav path And using received transfer folder of "user1" as dav path
And as "user1" the folder "/test" exists And as "user1" the folder "/test" exists
Scenario: transferring ownership from user with risky display name
Given user "user0" with displayname "user0 \"risky\"? ヂspḷay 'na|\/|e':.#" exists
And user "user1" exists
And User "user0" created a folder "/test"
And User "user0" uploads file "data/textfile.txt" to "/test/somefile.txt"
When transferring ownership of path "test" from "user0" to "user1"
And the command was successful
And As an "user1"
And using received transfer folder of "user1" as dav path
Then Downloaded content when downloading file "/test/somefile.txt" with range "bytes=0-6" should be "This is"
And transfer folder name contains "transferred from user0 -risky- ヂspḷay -na|-|e- on"
And using old dav path
And as "user0" the folder "/test" does not exist
And using received transfer folder of "user1" as dav path
And as "user1" the folder "/test" exists
Scenario: transferring ownership of file shares Scenario: transferring ownership of file shares
Given user "user0" exists Given user "user0" exists
And user "user1" exists And user "user1" exists