Function TestCheckURLPathTraversal

github/github_test.go:1681–1713

(t *testing.T)

}

func TestCheckURLPathTraversal(t *testing.T) {
	t.Parallel()
	tests := []struct {
		input   string
		wantErr error
	}{
		{"repos/o/r/contents/file.txt", nil},
		{"repos/o/r/contents/dir/file.txt", nil},
		{"repos/o/r/contents/file..txt", nil},
		{"repos/o/r?q=a..b", nil},
		{"repos/../admin/users", ErrPathForbidden},
		{"repos/x/../../../admin", ErrPathForbidden},
		{"../admin", ErrPathForbidden},
		{"repos/o/r/contents/..", ErrPathForbidden},
		{"repos/o/r/contents/../secrets", ErrPathForbidden},
		// Full URLs with scheme.
		{"https://api.github.com/repos/../admin", ErrPathForbidden},
		{"https://api.github.com/repos/o/r/contents/file.txt", nil},
		{"https://api.github.com/repos/o/r/contents/file..txt", nil},
		// URL with fragment.
		{"repos/o/r/contents/file.txt#section", nil},
		{"repos/../admin#frag", ErrPathForbidden},
		// URL with userinfo.
		{"https://user:pass@api.github.com/repos/../admin", ErrPathForbidden},
		{"https://user:pass@api.github.com/repos/o/r", nil},
	}
	for _, tt := range tests {
		err := checkURLPathTraversal(tt.input)
		if !errors.Is(err, tt.wantErr) {
			t.Errorf("checkURLPathTraversal(%q) = %v, want %v", tt.input, err, tt.wantErr)
		}
	}
}

func TestNewRequest_pathTraversal(t *testing.T) {
	t.Parallel()