Skip to content

test/nginx: prevent request() from normalising paths#1949

Merged
alxndrsn merged 8 commits into
getodk:nextfrom
alxndrsn:allow-path-traversal
Jun 7, 2026
Merged

test/nginx: prevent request() from normalising paths#1949
alxndrsn merged 8 commits into
getodk:nextfrom
alxndrsn:allow-path-traversal

Conversation

@alxndrsn
Copy link
Copy Markdown
Contributor

@alxndrsn alxndrsn commented Jun 4, 2026

This will be useful for testing nginx config at some point, and very misleading if trying to test path normalisation differences and request() collapses path traversals.

What has been done to verify that this works as intended?

  • existing tests pass
  • checked with new tests relating to collapsed path-traversal

Why is this the best possible solution? Were any other approaches considered?

While not immediately used, this will be useful for testing nginx config at some point, and very misleading if trying to test path normalisation differences and request() collapses path traversals.

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

No effect.

Does this change require updates to documentation? If so, please file an issue here and include the link below.

No.

Before submitting this PR, please make sure you have:

  • branched off and targeted the next branch OR only changed documentation/infrastructure (master is stable and used in production)
  • verified that any code or assets from external sources are properly credited in comments or that everything is internally sourced

This will be useful for testing nginx config at some point, and very misleading if trying to test path normalisation differences if request() collapses path traversals.
@alxndrsn alxndrsn marked this pull request as ready for review June 4, 2026 15:01
Comment thread test/nginx/src/mocha/nginx.spec.js Outdated
Comment thread test/nginx/src/mocha/nginx.spec.js Outdated
@alxndrsn alxndrsn merged commit 4ec096d into getodk:next Jun 7, 2026
6 checks passed
@alxndrsn alxndrsn deleted the allow-path-traversal branch June 7, 2026 11:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants