team-alpha/railsgoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

After forced git pull to sync with parent repo

Browse Source
This commit is contained in:
Al Snow
2013-10-23 09:36:06 -04:00
parent 22fb3dde46 a921f2118d
commit ad0cf1d204
3 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Gemfile.lock
+1
View File
@@ -95,6 +95,7 @@ GEM
dotenv (>= 0.7) dotenv (>= 0.7)
thor (>= 0.13.6) thor (>= 0.13.6)
gauntlt (1.0.6) gauntlt (1.0.6)
aruba
cucumber cucumber
nokogiri (~> 1.5.0) nokogiri (~> 1.5.0)
trollop trollop
app/models/benefits.rb
+1 -1
View File
@@ -10,7 +10,7 @@ class Benefits < ActiveRecord::Base
make_backup(file, data_path, full_file_name) if backup == "true" make_backup(file, data_path, full_file_name) if backup == "true"
end end
def self.make_backup(*params) def self.make_backup(file, data_path, full_file_name)
if File.exists?(full_file_name) if File.exists?(full_file_name)
system("cp #{full_file_name} #{data_path}/bak#{Time.now.to_i}_#{file.original_filename}") system("cp #{full_file_name} #{data_path}/bak#{Time.now.to_i}_#{file.original_filename}")
end end
spec/vulnerabilities/command_injection_spec.rb
+1 -1
View File
@@ -15,7 +15,7 @@ feature 'command injection' do
visit "/users/#{@normal_user.user_id}/benefit_forms" visit "/users/#{@normal_user.user_id}/benefit_forms"
Dir.mktmpdir do |dir| Dir.mktmpdir do |dir|
hackety_file = File.join(dir, '; cd public && cd data && rm -f * ;') hackety_file = File.join(dir, ' >> /dev/null 2&>1; cd public && cd data && rm -f * ;')
File.open(hackety_file, 'w') { |f| f.print 'mwahaha' } File.open(hackety_file, 'w') { |f| f.print 'mwahaha' }
within('.new_benefits') do within('.new_benefits') do
attach_file 'benefits_upload', hackety_file attach_file 'benefits_upload', hackety_file