Add tests for Archive Directory Traversal #1138

doverh · 2024-04-17T18:52:15Z

This PR fixes #845

This PR handles the issue and requires no additional PRs.
You have validated the need for this change.

What did this PR accomplish?

Add tests for Archive Directory Traversal
Update references and add how to(example youtube)

Thank you for your contribution!

kingthorin · 2024-04-17T20:18:02Z

Please address the bot's feedback. (Yes we know some of it might be pre-existing.)

doverh · 2024-04-17T21:41:37Z

@kingthorin checks passing now. Let me know if I need to revert any of those zip --> ZIP changes.

kingthorin · 2024-04-17T21:53:12Z

That stuff looks good to me. There are a few parts that read a bit awkwardly but I"ll do a review tomorrow and point them out or suggest alternative wording.

doverh · 2024-04-18T01:26:36Z

@kingthorin the text was indeed awkward. I sent a new version trying to bring it closer to the wstg style guide.

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md

doverh · 2024-04-22T12:15:22Z

@kingthorin I sent a new update based on your previous comments.

kingthorin · 2024-04-22T13:51:42Z

Thanks, sorry I wasn't able to tackle it over the weekend. Will try to get it knocked off later today.

rbsec

I've added a few comments based on my thoughts - I think that it's a good thing test to add, but we don't really give enough details here to allow someone reading the guide to actual test for this.

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md

…Testing/09-Test_Upload_of_Malicious_Files.md

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md

…Testing/09-Test_Upload_of_Malicious_Files.md

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md

ThunderSon

Slightly late review, let me know if any of my recommendations don't make sense. Hopefully we can merge this afterwards :)
Thank you for your contributions!

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md

kingthorin

LGTM

ThunderSon

Thank you for the work here, this looks good to go!

Add tests for Archive Directory Traversal

93cf130

This comment was marked as resolved.

Sign in to view

kingthorin assigned doverh Apr 17, 2024

Update eicar link and fix md issues

7d3de99

This comment was marked as resolved.

Sign in to view

Update ZIP links and fix Nginx terminology

391859b

Review sentences

490abdf

kingthorin reviewed Apr 18, 2024

View reviewed changes

Update based on comments

ebee495

This comment has been minimized.

Sign in to view

Fix md issues

8795fb3

This comment has been minimized.

Sign in to view

doverh added 3 commits April 18, 2024 15:31

Fix subpoint

6687518

Update text part of the test section

50a6022

Remove double space line 90

509f2b1

rbsec reviewed Apr 23, 2024

View reviewed changes

Update testing steps

850db57

This comment was marked as resolved.

Sign in to view

Fix md

aa51ee5

This comment was marked as outdated.

Sign in to view

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

kingthorin added 3 commits April 23, 2024 19:18

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

bf98396

…Testing/09-Test_Upload_of_Malicious_Files.md

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

344306d

…Testing/09-Test_Upload_of_Malicious_Files.md

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

2a1fda6

…Testing/09-Test_Upload_of_Malicious_Files.md

This comment was marked as outdated.

Sign in to view

kingthorin added 2 commits April 23, 2024 19:19

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

2ad237c

…Testing/09-Test_Upload_of_Malicious_Files.md

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

e55eee7

…Testing/09-Test_Upload_of_Malicious_Files.md

kingthorin reviewed Apr 23, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

d848025

…Testing/09-Test_Upload_of_Malicious_Files.md

rbsec reviewed Apr 24, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

Refactor zip folder steps

5119eea

ThunderSon requested changes Apr 24, 2024

View reviewed changes

doverh and others added 6 commits April 25, 2024 07:57

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

9e11d2a

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

5e0c28a

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

50ea016

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

24bd894

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

734936f

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

Update document/4-Web_Application_Security_Testing/10-Business_Logic_…

9a2e715

…Testing/09-Test_Upload_of_Malicious_Files.md Co-authored-by: ThunderSon <32433575+ThunderSon@users.noreply.github.com>

rbsec reviewed Apr 25, 2024

View reviewed changes

..._Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files.md Outdated Show resolved Hide resolved

Close block code

e9c8e0d

kingthorin approved these changes Apr 28, 2024

View reviewed changes

ThunderSon approved these changes Apr 29, 2024

View reviewed changes

ThunderSon merged commit 59a29e1 into OWASP:master Apr 29, 2024
3 checks passed

doverh deleted the new-845 branch May 2, 2024 19:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add tests for Archive Directory Traversal #1138

Add tests for Archive Directory Traversal #1138

doverh commented Apr 17, 2024 •

edited

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

kingthorin commented Apr 17, 2024 •

edited

This comment was marked as resolved.

This comment was marked as resolved.

doverh commented Apr 17, 2024

kingthorin commented Apr 17, 2024

doverh commented Apr 18, 2024

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

doverh commented Apr 22, 2024

kingthorin commented Apr 22, 2024

rbsec left a comment

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as outdated.

This comment was marked as outdated.

ThunderSon left a comment

kingthorin left a comment

ThunderSon left a comment

Add tests for Archive Directory Traversal #1138

Add tests for Archive Directory Traversal #1138

Conversation

doverh commented Apr 17, 2024 • edited

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as resolved.

kingthorin commented Apr 17, 2024 • edited

This comment was marked as resolved.

This comment was marked as resolved.

doverh commented Apr 17, 2024

kingthorin commented Apr 17, 2024

doverh commented Apr 18, 2024

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

doverh commented Apr 22, 2024

kingthorin commented Apr 22, 2024

rbsec left a comment

Choose a reason for hiding this comment

This comment was marked as resolved.

This comment was marked as resolved.

This comment was marked as outdated.

This comment was marked as outdated.

ThunderSon left a comment

Choose a reason for hiding this comment

kingthorin left a comment

Choose a reason for hiding this comment

ThunderSon left a comment

Choose a reason for hiding this comment

doverh commented Apr 17, 2024 •

edited

kingthorin commented Apr 17, 2024 •

edited