view tests/readlink.py @ 28663:ae279d4a19e9 stable 3.7.3

convert: test for shell injection in git calls (SEC)

CVE-2016-3069 (5/5)

Before recent refactoring we were not escaping calls to git at all
which made such injections possible. Let's have a test for that to
avoid this problem in the future. Reported by Blake Burkhart.

#!/usr/bin/env python

import errno, os, sys

for f in sys.argv[1:]:
    try:
        print f, '->', os.readlink(f)
    except OSError as err:
        if err.errno != errno.EINVAL:
            raise
        print f, 'not a symlink'

sys.exit(0)