The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-14 11:06:13 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Cover malicious feed add input

Browse Source
This commit is contained in:
Nick Sweeting 2026-06-08 23:32:52 -07:00
parent 5adec53b4c
commit f59af9cb2a
No known key found for this signature in database
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
archivebox/tests/test_cli_add.py
View File

@ -208,6 +208,16 @@ def malicious_add_inputs(tmp_path: Path, *, safe_url: str) -> tuple[list[str], P
f'" && touch {canary} && echo "',
f"$(touch {canary})",
f"`touch {canary}`",
"""<?xml version="1.0"?>
<!DOCTYPE rss [
<!ENTITY localfile SYSTEM "file:///etc/hosts">
]>
<rss version="2.0" xmlns:xi="http://www.w3.org/2001/XInclude">
<channel>
<item><title>&localfile;</title><link>file:///etc/passwd</link></item>
<xi:include href="file:///etc/hosts" parse="text"/>
</channel>
</rss>""",
],
canary,
)