add path traversal test

Signed-off-by: Spencer Schrock <sschrock@google.com>
ossf · Jan 2, 2025 · 0db4245 · 0db4245
1 parent 498e3c5
commit 0db4245
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/internal/gitfile/gitfile_test.go b/internal/gitfile/gitfile_test.go
@@ -16,6 +16,7 @@ package gitfile
 
 import (
 	"context"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
@@ -69,6 +70,19 @@ func TestHandler(t *testing.T) {
 	}
 }
 
+func TestHandlerPathTraversal(t *testing.T) {
+	t.Parallel()
+	dir := setupGitRepo(t)
+
+	var h Handler
+	h.Init(context.Background(), dir, "HEAD")
+
+	_, err := h.GetFile("../example.txt")
+	if !errors.Is(err, errPathTraversal) {
+		t.Fatalf("expected path traversal error: got %v", err)
+	}
+}
+
 func setupGitRepo(t *testing.T) string {
 	t.Helper()