test1231 911 B

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960
  1. <testcase>
  2. <info>
  3. <keywords>
  4. HTTP
  5. HTTP GET
  6. dotdot removal
  7. </keywords>
  8. </info>
  9. #
  10. # Server-side
  11. <reply>
  12. <data>
  13. HTTP/1.1 200 OK
  14. Content-Length: 6
  15. Connection: close
  16. -foo-
  17. </data>
  18. <data1>
  19. HTTP/1.1 200 OK
  20. Content-Length: 7
  21. Connection: close
  22. -cool-
  23. </data1>
  24. </reply>
  25. #
  26. # Client-side
  27. <client>
  28. <server>
  29. http
  30. </server>
  31. <name>
  32. HTTP URL with dotdot removal from path
  33. </name>
  34. <command>
  35. http://%HOSTIP:%HTTPPORT/../../hej/but/who/../%TESTNUMBER?stupid=me/../%TESTNUMBER#soo/../%TESTNUMBER http://%HOSTIP:%HTTPPORT/../../hej/but/who/../%TESTNUMBER0001#/../%TESTNUMBER0001
  36. </command>
  37. </client>
  38. #
  39. # Verify data after the test has been "shot"
  40. <verify>
  41. <protocol>
  42. GET /hej/but/%TESTNUMBER?stupid=me/../%TESTNUMBER HTTP/1.1
  43. Host: %HOSTIP:%HTTPPORT
  44. User-Agent: curl/%VERSION
  45. Accept: */*
  46. GET /hej/but/%TESTNUMBER0001 HTTP/1.1
  47. Host: %HOSTIP:%HTTPPORT
  48. User-Agent: curl/%VERSION
  49. Accept: */*
  50. </protocol>
  51. </verify>
  52. </testcase>