Raised SuspiciousFileOperation in safe_join.

Added a test for the condition safe_join is designed to prevent.

Previously, a generic ValueError was raised. It was impossible to tell
an intentional exception raised to implement safe_join's contract from
an unintentional exception caused by incorrect inputs or unexpected
conditions. That resulted in bizarre exception catching patterns, which
this patch removes.

Since safe_join is a private API and since the change is unlikely to
create security issues for users who use it anyway -- at worst, an
uncaught SuspiciousFileOperation exception will bubble up -- it isn't
documented.
This commit is contained in:
Aymeric Augustin 2014-11-11 18:59:49 +01:00
parent 40ba6f21bb
commit b8ba73cd0c
5 changed files with 18 additions and 19 deletions

View file

@ -1,6 +1,7 @@
import os
import unittest
from django.core.exceptions import SuspiciousFileOperation
from django.utils._os import safe_join
@ -24,3 +25,7 @@ class SafeJoinTests(unittest.TestCase):
path,
os.path.sep,
)
def test_parent_path(self):
with self.assertRaises(SuspiciousFileOperation):
safe_join("/abc/", "../def")