diff --git a/test/source/_posts/2014-01-06-permalink-traversal.md b/test/source/_posts/2014-01-06-permalink-traversal.md new file mode 100644 index 00000000..1b3fdf88 --- /dev/null +++ b/test/source/_posts/2014-01-06-permalink-traversal.md @@ -0,0 +1,5 @@ +--- +permalink: /%2e%2e/baddie.html +--- + +# Test diff --git a/test/test_post.rb b/test/test_post.rb index 418e60d7..580f0065 100644 --- a/test/test_post.rb +++ b/test/test_post.rb @@ -103,6 +103,15 @@ class TestPost < Test::Unit::TestCase assert_equal "/my_category/permalinked-post", @post.url end + should "not be writable outside of destination" do + post = setup_post("2014-01-06-permalink-traversal.md") + do_render(post) + post.write(dest_dir) + + assert !File.exist?(File.expand_path("../baddie.html", dest_dir)) + assert File.exist(File.expand_path("/baddie.html", dest_dir)) + end + context "with CRLF linebreaks" do setup do @real_file = "2009-05-24-yaml-linebreak.markdown"