KES777 / mojo

Mojolicious - Perl real-time web framework
http://mojolicio.us
Artistic License 2.0
0 stars 0 forks source link

possible security hole #37

Open KES777 opened 6 years ago

KES777 commented 6 years ago
index fd1878f5b..70b6d83f4 100644
--- a/t/mojolicious/layouted_lite_app.t
+++ b/t/mojolicious/layouted_lite_app.t
@@ -124,6 +124,8 @@ get '/variants' => {layout => 'variants'} => sub {
   $c->render('variants');
 };

+get '/secure';
+
 my $t = Test::Mojo->new;

 # "0" content reassignment
@@ -297,6 +299,16 @@ $t->get_ok('/variants.txt?device=0')->status_is(200)
   ->content_type_is('text/plain;charset=UTF-8')
   ->content_is('Another variant: Desktop!');

+# Do not render everything
+$t->get_ok('/secure')->status_is(200)
+  ->content_type_is('text/html;charset=UTF-8')
+  ->content_is("Defaultsecure\n\n");
+
+$DB::stop =  1;
+$t->get_ok('/secure.hacked')->status_is(200)
+  ->content_type_is('text/html;charset=UTF-8')
+  ->content_is("Defaultsecure\n\n");
+
 done_testing();

 __DATA__
@@ -482,3 +494,9 @@ Desktop!\

 @@ variants.txt+tablet.epl
 Tablet!\
+
+@@ secure.html.ep
+secure
+
+@@ secure.hacked.ep
+hacked