Skip to content

Commit

Permalink
Add Malformed S3 URL test
Browse files Browse the repository at this point in the history
The added tests validates that the Go-Getter client for when getting an
invalid S3 URL does not panic, as described in CVE-2022-41605.
  • Loading branch information
nywilken committed Oct 27, 2022
1 parent 049d4d0 commit 9ce053f
Showing 1 changed file with 29 additions and 0 deletions.
29 changes: 29 additions & 0 deletions s3/get_s3_test.go
Expand Up @@ -5,6 +5,7 @@ import (
"net/url"
"os"
"path/filepath"
"strings"
"testing"

"github.com/aws/aws-sdk-go/aws/awserr"
Expand Down Expand Up @@ -226,6 +227,34 @@ func TestGetter_Mode_collision(t *testing.T) {
}
}

func TestGetAny_S3_malformed(t *testing.T) {
ctx := context.Background()

g := new(Getter)
dst := testing_helper.TempTestFile(t)
defer os.RemoveAll(filepath.Dir(dst))

req := &getter.Request{
Src: "s3::https://s3-eu-west-2.amazonaws.com/picat-was-here//malformed",
Dst: dst,
GetMode: getter.ModeFile,
}

c := getter.Client{
Getters: []getter.Getter{g},
}

_, err := c.Get(ctx, req)
if err == nil {
t.Fatalf("expected error, got none")
}

expectedErrMsg := "URL is not a valid S3 URL"
if !strings.Contains(err.Error(), expectedErrMsg) {
t.Fatalf("expected %q error, but got %v", expectedErrMsg, err)
}
}

func TestGetter_Url(t *testing.T) {
var s3tests = []struct {
name string
Expand Down

0 comments on commit 9ce053f

Please sign in to comment.