Clean files and catch file path escape. Ref #1894

tests/api/routes/compute/test_dynamips_nodes.py

@@ -186,6 +186,13 @@ async def test_upload_image(app: FastAPI, client: AsyncClient, images_dir: str)
         assert checksum == "033bd94b1168d7e4f0d644c3c95e35bf"
 
 
+async def test_download_image_escape(app: FastAPI, client: AsyncClient, tmpdir) -> None:
+
+    file_path = "foo/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+    response = await client.get(app.url_path_for("download_dynamips_image", filename=file_path))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
 @pytest.mark.skipif(not sys.platform.startswith("win") and os.getuid() == 0, reason="Root can delete any image")
 async def test_upload_image_permission_denied(app: FastAPI, client: AsyncClient, images_dir: str) -> None:
 

tests/api/routes/compute/test_iou_nodes.py

@@ -401,10 +401,10 @@ async def test_images(app: FastAPI, client: AsyncClient, fake_iou_bin: str) -> N
     assert response.json() == [{"filename": "iou.bin", "path": "iou.bin", "filesize": 7, "md5sum": "e573e8f5c93c6c00783f20c7a170aa6c"}]
 
 
-async def test_image_vm(app: FastAPI, client: AsyncClient, tmpdir) -> None:
+async def test_upload_image(app: FastAPI, client: AsyncClient, tmpdir) -> None:
 
     with patch("gns3server.compute.IOU.get_images_directory", return_value=str(tmpdir)):
-        response = await client.post(app.url_path_for("download_iou_image", filename="test2"), content=b"TEST")
+        response = await client.post(app.url_path_for("upload_iou_image", filename="test2"), content=b"TEST")
         assert response.status_code == status.HTTP_204_NO_CONTENT
 
     with open(str(tmpdir / "test2")) as f:
@@ -415,6 +415,13 @@ async def test_image_vm(app: FastAPI, client: AsyncClient, tmpdir) -> None:
         assert checksum == "033bd94b1168d7e4f0d644c3c95e35bf"
 
 
+async def test_download_image_escape(app: FastAPI, client: AsyncClient, tmpdir) -> None:
+
+    file_path = "foo/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+    response = await client.get(app.url_path_for("download_iou_image", filename=file_path))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
 async def test_iou_duplicate(app: FastAPI, client: AsyncClient, vm: dict, base_params: dict) -> None:
 
     # create destination node first

tests/api/routes/compute/test_qemu_nodes.py

@@ -396,6 +396,13 @@ async def test_upload_image_forbiden_location(app: FastAPI, client: AsyncClient,
         assert response.status_code == status.HTTP_403_FORBIDDEN
 
 
+async def test_download_image_escape(app: FastAPI, client: AsyncClient, tmpdir) -> None:
+
+    file_path = "foo/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
+    response = await client.get(app.url_path_for("download_qemu_image", filename=file_path))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
 @pytest.mark.skipif(not sys.platform.startswith("win") and os.getuid() == 0, reason="Root can delete any image")
 async def test_upload_image_permission_denied(app: FastAPI, client: AsyncClient, images_dir: str) -> None:
 

tests/api/routes/controller/test_nodes.py

@@ -240,6 +240,7 @@ async def test_get_file(app: FastAPI, client: AsyncClient, project: Project, com
 
     response = MagicMock()
     response.body = b"world"
+    response.status = status.HTTP_200_OK
     compute.http_query = AsyncioMagicMock(return_value=response)
 
     response = await client.get(app.url_path_for("get_file", project_id=project.id, node_id=node.id, file_path="hello"))