mirror of
https://github.com/rookiestar28/ComfyUI-OpenClaw.git
synced 2026-08-14 00:48:07 +00:00
39 lines
1.2 KiB
Python
39 lines
1.2 KiB
Python
import os
|
|
import shutil
|
|
import tempfile
|
|
import unittest
|
|
import zipfile
|
|
|
|
from services.packs.pack_archive import PackArchive, PackError
|
|
|
|
|
|
class TestS53ZipSlip(unittest.TestCase):
|
|
def setUp(self):
|
|
self.tmp = tempfile.mkdtemp(prefix="wave_b_s53_")
|
|
|
|
def tearDown(self):
|
|
shutil.rmtree(self.tmp, ignore_errors=True)
|
|
|
|
def test_unicode_traversal(self):
|
|
zip_path = os.path.join(self.tmp, "unicode_traversal.zip")
|
|
# U+FF0E FULLWIDTH FULL STOP x2 normalizes to ".." under NFKC.
|
|
unsafe_name = "\uFF0E\uFF0E/evil.txt"
|
|
|
|
with zipfile.ZipFile(zip_path, "w") as zf:
|
|
zf.writestr(unsafe_name, "payload")
|
|
|
|
with self.assertRaisesRegex(PackError, "Unsafe filename"):
|
|
PackArchive.extract_pack(zip_path, os.path.join(self.tmp, "out"))
|
|
|
|
def test_drive_relative_path_rejected(self):
|
|
zip_path = os.path.join(self.tmp, "drive_relative.zip")
|
|
with zipfile.ZipFile(zip_path, "w") as zf:
|
|
zf.writestr("C:evil.txt", "payload")
|
|
|
|
with self.assertRaisesRegex(PackError, "Unsafe filename"):
|
|
PackArchive.extract_pack(zip_path, os.path.join(self.tmp, "out2"))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|