Merge pull request #1074 from dritter/add_vcs_vulnerability_tests_master

Add vcs vulnerability tests master
pull/22/head
Dominik Ritter 6 years ago committed by GitHub
commit 67fd577217
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

@ -490,4 +490,17 @@ function testDetectingUntrackedFilesInCleanSubdirectoryWorks() {
assertEquals "%K{002} %F{000} master ? %k%F{002}%f " "$(build_left_prompt)"
}
function testBranchNameScriptingVulnerability() {
local -a POWERLEVEL9K_LEFT_PROMPT_ELEMENTS
POWERLEVEL9K_LEFT_PROMPT_ELEMENTS=(vcs)
echo "#!/bin/sh\n\necho 'hacked'\n" > evil_script.sh
chmod +x evil_script.sh
git checkout -b '$(./evil_script.sh)' 2>/dev/null
git add . 2>/dev/null
git commit -m "Initial commit" >/dev/null
assertEquals '%K{002} %F{000} $(./evil_script.sh) %k%F{002}%f ' "$(build_left_prompt)"
}
source shunit2/shunit2

@ -204,4 +204,17 @@ function testBookmarkIconWorks() {
assertEquals "%K{002} %F{000} default Binitial %k%F{002}%f " "$(build_left_prompt)"
}
source shunit2/shunit2
function testBranchNameScriptingVulnerability() {
local -a POWERLEVEL9K_LEFT_PROMPT_ELEMENTS
POWERLEVEL9K_LEFT_PROMPT_ELEMENTS=(vcs)
echo "#!/bin/sh\n\necho 'hacked'\n" > evil_script.sh
chmod +x evil_script.sh
hg branch '$(./evil_script.sh)' >/dev/null
hg add . >/dev/null
hg commit -m "Initial commit" >/dev/null
assertEquals '%K{002} %F{000} $(./evil_script.sh) %k%F{002}%f ' "$(build_left_prompt)"
}
source shunit2/shunit2

Loading…
Cancel
Save