File tree Expand file tree Collapse file tree
handlebars/src/test/java/com/github/jknack/handlebars/io Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -57,8 +57,9 @@ public void shouldBlockTraversalWithEmptySuffix() throws IOException {
5757 // Configure the loader with an empty suffix
5858 FileTemplateLoader loader = new FileTemplateLoader (baseDir .toFile (), "" );
5959
60- // Attempt to traverse up and access the exact file
61- String traversalPath = "../../../../../../../../../.." + sensitiveConfig .toAbsolutePath ();
60+ // Calculate a valid relative traversal path from baseDir to sensitiveConfig
61+ // and ensure we use standard forward slashes for the test payload.
62+ String traversalPath = baseDir .relativize (sensitiveConfig ).toString ().replace ('\\' , '/' );
6263
6364 IllegalArgumentException exception =
6465 assertThrows (
@@ -84,10 +85,10 @@ public void shouldLoadValidTemplate() throws IOException {
8485 public void shouldBlockDirectoryTraversalEscapingBaseDir () {
8586 FileTemplateLoader loader = new FileTemplateLoader (baseDir .toFile (), ".hbs" );
8687
87- // Attempt to traverse up and access the secret file
88+ // Calculate the valid relative traversal path from baseDir to secretFile
89+ // and strip the .hbs extension as the loader will automatically append it.
8890 String traversalPath =
89- "../../../../../../../../../.."
90- + secretFile .toAbsolutePath ().toString ().replace (".hbs" , "" );
91+ baseDir .relativize (secretFile ).toString ().replace ('\\' , '/' ).replace (".hbs" , "" );
9192
9293 IllegalArgumentException exception =
9394 assertThrows (
You can’t perform that action at this time.
0 commit comments