test: fix defect path traversal tests

tniessen · targos · commit 7cd406a0b8c4 · 2023-11-11T20:26:19.000+01:00
The test never actually tested what it claims to test because it did not properly insert separators before `..`. PR-URL: #50124 Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
diff --git a/test/fixtures/permission/fs-traversal.js b/test/fixtures/permission/fs-traversal.js
@@ -12,9 +12,9 @@ path.resolve = (s) => s;
 
 const blockedFolder = process.env.BLOCKEDFOLDER;
 const allowedFolder = process.env.ALLOWEDFOLDER;
-const traversalPath = allowedFolder + '../file.md';
-const traversalFolderPath = allowedFolder + '../folder';
-const bufferTraversalPath = Buffer.from(allowedFolder + '../file.md');
+const traversalPath = allowedFolder + '/../file.md';
+const traversalFolderPath = allowedFolder + '/../folder';
+const bufferTraversalPath = Buffer.from(traversalPath);
 const uint8ArrayTraversalPath = new TextEncoder().encode(traversalPath);
 
 {
diff --git a/test/parallel/test-permission-fs-traversal-path.js b/test/parallel/test-permission-fs-traversal-path.js
@@ -18,7 +18,7 @@ const tmpdir = require('../common/tmpdir');
 
 const file = fixtures.path('permission', 'fs-traversal.js');
 const blockedFolder = tmpdir.path;
-const allowedFolder = tmpdir.resolve('subdirectory/');
+const allowedFolder = tmpdir.resolve('subdirectory');
 const commonPathWildcard = path.join(__filename, '../../common*');
 
 {

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ const tmpdir = require('../common/tmpdir');`
`18`	`18`
`19`	`19`	`const file = fixtures.path('permission', 'fs-traversal.js');`
`20`	`20`	`const blockedFolder = tmpdir.path;`
`21`		`-const allowedFolder = tmpdir.resolve('subdirectory/');`
	`21`	`+const allowedFolder = tmpdir.resolve('subdirectory');`
`22`	`22`	`const commonPathWildcard = path.join(__filename, '../../common*');`
`23`	`23`
`24`	`24`	`{`