diff --git a/app/models/benefits.rb b/app/models/benefits.rb index c423a38..88ab57e 100644 --- a/app/models/benefits.rb +++ b/app/models/benefits.rb @@ -11,10 +11,9 @@ class Benefits < ActiveRecord::Base end def self.make_backup(file, data_path, full_file_name) - if File.exists?(full_file_name) + if File.exists?(full_file_name) system("cp #{full_file_name} #{data_path}/bak#{Time.now.to_i}_#{file.original_filename}") - end - rescue + end end =begin diff --git a/spec/vulnerabilities/command_injection_spec.rb b/spec/vulnerabilities/command_injection_spec.rb index e90ad7e..8baed81 100644 --- a/spec/vulnerabilities/command_injection_spec.rb +++ b/spec/vulnerabilities/command_injection_spec.rb @@ -15,7 +15,7 @@ feature 'command injection' do visit "/users/#{@normal_user.user_id}/benefit_forms" Dir.mktmpdir do |dir| - hackety_file = File.join(dir, 'etc/passwd; cd public && cd data && rm -f * ;') + hackety_file = File.join(dir, 'test; cd public && cd data && rm -f * ;') File.open(hackety_file, 'w') { |f| f.print 'mwahaha' } within('.new_benefits') do attach_file 'benefits_upload', hackety_file @@ -25,4 +25,4 @@ feature 'command injection' do end pending(:if => verifying_fixed?) { File.exists?(legit_file).should be_false } end -end +end \ No newline at end of file