From 01458fb0f514948028efacef1b10ff7476f0df73 Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Wed, 23 Oct 2013 18:27:11 -0400 Subject: [PATCH] this reduces the error but we still need to rescue the file not found error. for another day. --- spec/vulnerabilities/command_injection_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/vulnerabilities/command_injection_spec.rb b/spec/vulnerabilities/command_injection_spec.rb index 7ebcdaa..e90ad7e 100644 --- a/spec/vulnerabilities/command_injection_spec.rb +++ b/spec/vulnerabilities/command_injection_spec.rb @@ -15,7 +15,7 @@ feature 'command injection' do visit "/users/#{@normal_user.user_id}/benefit_forms" Dir.mktmpdir do |dir| - hackety_file = File.join(dir, 'test.txt; cd public && cd data && rm -f * ;') + hackety_file = File.join(dir, 'etc/passwd; cd public && cd data && rm -f * ;') File.open(hackety_file, 'w') { |f| f.print 'mwahaha' } within('.new_benefits') do attach_file 'benefits_upload', hackety_file