rust-embed

rust macro which loads files into the rust binary at compile time during release and loads the file from the fs during dev.

23c8cbf2 — Buckram

add symlink traversal attack test

Files changed (1) hide show

tests/path_traversal_attack.rs CHANGED Viewed

@@ -11,3 +11,17 @@ struct Assets;
 fn path_traversal_attack_fails() {
   assert!(Assets::get("../basic.rs").is_none());
 }
+#[derive(RustEmbed)]
+#[folder = "examples/axum-spa/"]
+struct AxumAssets;
+// TODO:
+/// Prevent attempts to access symlinks outside of the embedded folder.
+/// This is mainly a concern when running in debug mode, since that loads from
+/// the file system at runtime.
+#[test]
+#[ignore = "see https://github.com/pyrossh/rust-embed/pull/235"]
+fn path_traversal_attack_symlink_fails() {
+  assert!(Assets::get("../public/symlinks/main.js").is_none());
+}