does not fix the error that occurs (as it should, but that we want to obfuscate) when a command is injected into, however, it does pass the build and does not break the entire call

2013-10-23 17:11:28 -05:00
parent a921f2118d
commit 7c1d52320a
2 changed files with 4 additions and 3 deletions
@@ -15,7 +15,7 @@ feature 'command injection' do

    visit "/users/#{@normal_user.user_id}/benefit_forms"
    Dir.mktmpdir do |dir|
-      hackety_file = File.join(dir, ' >> /dev/null 2&>1; cd public && cd data && rm -f * ;')
+      hackety_file = File.join(dir, 'test.txt; cd public && cd data && rm -f * ;')
      File.open(hackety_file, 'w') { |f| f.print 'mwahaha' }
      within('.new_benefits') do
        attach_file 'benefits_upload', hackety_file