wt/cpp-httplib
1
0
Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-10-04 06:14:21 +07:00
Code Issues Packages Projects Releases Wiki Activity

Add filename sanitization function and tests to prevent path traversal vulnerabilities

Browse Source
This commit is contained in:
yhirose
2026-03-13 00:29:13 -04:00
parent 4d7c9a788d
commit 83e98a28dd
3 changed files with 59 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/test.cc
+19
View File
@@ -413,6 +413,25 @@ TEST(DecodePathTest, PercentCharacterNUL) {
EXPECT_EQ(decode_path_component("x%00x"), expected);
}
TEST(SanitizeFilenameTest, VariousPatterns) {
// Path traversal
EXPECT_EQ("passwd", httplib::sanitize_filename("../../../etc/passwd"));
EXPECT_EQ("passwd", httplib::sanitize_filename("..\\..\\etc\\passwd"));
EXPECT_EQ("file.txt", httplib::sanitize_filename("path/to\\..\\file.txt"));
// Normal and edge cases
EXPECT_EQ("photo.jpg", httplib::sanitize_filename("photo.jpg"));
EXPECT_EQ("filename.txt",
httplib::sanitize_filename("/path/to/filename.txt"));
EXPECT_EQ(".gitignore", httplib::sanitize_filename(".gitignore"));
EXPECT_EQ("", httplib::sanitize_filename(".."));
EXPECT_EQ("", httplib::sanitize_filename(""));
// Null bytes stripped
EXPECT_EQ("safe.txt",
httplib::sanitize_filename(std::string("safe\0.txt", 9)));
// Whitespace-only rejected
EXPECT_EQ("", httplib::sanitize_filename(" "));
}
TEST(EncodeQueryParamTest, ParseUnescapedChararactersTest) {
string unescapedCharacters = "-_.!~*'()";