test1231 852 B

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. <testcase>
  2. <info>
  3. <keywords>
  4. HTTP
  5. HTTP GET
  6. dotdot removal
  7. </keywords>
  8. </info>
  9. #
  10. # Server-side
  11. <reply name="1">
  12. <data>
  13. HTTP/1.1 200 OK
  14. Content-Length: 6
  15. Connection: close
  16. -foo-
  17. </data>
  18. <data1>
  19. HTTP/1.1 200 OK
  20. Content-Length: 7
  21. Connection: close
  22. -cool-
  23. </data1>
  24. </reply>
  25. #
  26. # Client-side
  27. <client>
  28. <server>
  29. http
  30. </server>
  31. <name>
  32. HTTP URL with dotdot removal from path
  33. </name>
  34. <command>
  35. http://%HOSTIP:%HTTPPORT/../../hej/but/who/../1231?stupid=me/../1231#soo/../1231 http://%HOSTIP:%HTTPPORT/../../hej/but/who/../12310001#/../12310001
  36. </command>
  37. </client>
  38. #
  39. # Verify data after the test has been "shot"
  40. <verify>
  41. <strip>
  42. ^User-Agent:.*
  43. </strip>
  44. <protocol>
  45. GET /hej/but/1231?stupid=me/../1231 HTTP/1.1
  46. Host: %HOSTIP:%HTTPPORT
  47. Accept: */*
  48. GET /hej/but/12310001 HTTP/1.1
  49. Host: %HOSTIP:%HTTPPORT
  50. Accept: */*
  51. </protocol>
  52. </verify>
  53. </testcase>