noNameWEB/livewire-material
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

404 a null byte or a directory on the showcase's asset route

Browse Source 
Plan step 38 review: a %00 in the asset path reached realpath(), which
throws on a null byte, so the route answered 500 instead of 404; a
directory whose name ended in a served extension would have reached
response()->file(). Both 404 now. The tests add what the review
probed: encoded dot segments and slashes, backslashes, absolute paths,
a directory, a very long path and a symbolic link pointing out of a
served folder, all 404.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qwx5USif3wFFmxtHg5U1g9
This commit is contained in:
Andreas Reinhold / reini
2026-09-15 06:08:39 +02:00
co-authored by Claude Opus 5
parent 2f649983fa
commit 3027f85cef
2 changed files with 33 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Feature/ShowcaseAssetsTest.php
+25
View File
@@ -54,6 +54,31 @@ it('404s a path that climbs out of the two served folders', function () {
$this->get('/material/assets/fonts/../../composer.json')->assertNotFound();
});
it('404s every other way out of the two served folders', function (string $path) {
$this->get('/material/assets/'.$path)->assertNotFound();
})->with([
'encoded dot segments' => 'fonts/%2e%2e/%2e%2e/composer.json',
'encoded slashes' => 'fonts/..%2f..%2fcomposer.json',
'backslashes' => 'fonts/google-sans-flex/..%5c..%5c..%5ccomposer.json',
'an absolute path' => '/etc/hosts',
'an absolute path inside a folder' => 'fonts//etc/hosts',
'a null byte' => 'fonts/google-sans-flex/GoogleSansFlex-Latin.woff2%00.txt',
'a directory' => 'svg/symbols',
'a folder itself' => 'fonts/',
'a very long path' => 'fonts/'.str_repeat('a/', 3000).'x.woff2',
]);
it('404s a symbolic link inside a served folder that points out of it', function () {
$link = __DIR__.'/../../resources/svg/showcase-assets-test-link.svg';
symlink(realpath(__DIR__.'/../../composer.json'), $link);
try {
$this->get('/material/assets/svg/showcase-assets-test-link.svg')->assertNotFound();
} finally {
unlink($link);
}
});
it('404s a folder the showcase does not serve', function () {
$this->get('/material/assets/css/all.css')->assertNotFound();
});