mirror of
https://github.com/django/django.git
synced 2025-10-09 18:12:39 +00:00
Raised SuspiciousFileOperation in safe_join.
Added a test for the condition safe_join is designed to prevent. Previously, a generic ValueError was raised. It was impossible to tell an intentional exception raised to implement safe_join's contract from an unintentional exception caused by incorrect inputs or unexpected conditions. That resulted in bizarre exception catching patterns, which this patch removes. Since safe_join is a private API and since the change is unlikely to create security issues for users who use it anyway -- at worst, an uncaught SuspiciousFileOperation exception will bubble up -- it isn't documented.
This commit is contained in:
parent
40ba6f21bb
commit
b8ba73cd0c
5 changed files with 18 additions and 19 deletions
|
@ -1,6 +1,7 @@
|
|||
import os
|
||||
import unittest
|
||||
|
||||
from django.core.exceptions import SuspiciousFileOperation
|
||||
from django.utils._os import safe_join
|
||||
|
||||
|
||||
|
@ -24,3 +25,7 @@ class SafeJoinTests(unittest.TestCase):
|
|||
path,
|
||||
os.path.sep,
|
||||
)
|
||||
|
||||
def test_parent_path(self):
|
||||
with self.assertRaises(SuspiciousFileOperation):
|
||||
safe_join("/abc/", "../def")
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue