[tests] Validate input when serving files in ProxyTest. (#21951)

Fixes https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2334856.
dotnet · Jan 14, 2025 · 3ffc1da · 3ffc1da
1 parent 1c16bfd
commit 3ffc1da
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/tests/monotouch-test/CoreFoundation/ProxyTest.cs b/tests/monotouch-test/CoreFoundation/ProxyTest.cs
@@ -76,6 +76,9 @@ public void Setup ()
 							var context = listener.GetContext ();
 							var request = context.Request;
 							var pacPath = Path.Combine (NSBundle.MainBundle.ResourcePath, request.RawUrl.Substring (1));
+							pacPath = Path.GetFullPath (pacPath);
+							if (!pacPath.StartsWith (Path.GetFullPath (NSBundle.MainBundle.ResourcePath) + Path.DirectorySeparatorChar))
+								throw new InvalidOperationException ($"Invalid access: {request.RawUrl}");
 							Console.WriteLine ($"    Serving {pacPath}");
 							var buf = File.ReadAllBytes (pacPath);
 							context.Response.ContentLength64 = buf.Length;