test: verify that /../ in request path can't access outside webroot

Sponsored-by: author

1 files changed, 28 insertions, 0 deletions

diff --git a/ewww.md b/ewww.md
index 97b8357..f9bad80 100644
--- a/ewww.md
+++ b/ewww.md
@@ -164,4 +164,32 @@ then I get status code 405
 and allow is "GET HEAD"
 ~~~
 
+## Request asking file from parent of webroot fails
 
+The HTTP client must not be able to escape the webroot by using `/../`
+in the request path.
+
+~~~scenario
+given a self-signed certificate as snakeoil.pem, using key snakeoil.key
+given directory somedir/webroot
+given file somedir/secret.txt from secret.txt
+given file somedir/webroot/foo.html from webpage.html
+given a running server using config file somedir.yaml
+
+when I request GET https://example.com/foo.html
+then I get status code 200
+then body is "this is your web page"
+
+when I request GET https://example.com/../secret.txt
+then I get status code 404
+~~~
+
+~~~{#somedir.yaml .file .yaml .numberLines}
+webroot: somedir/webroot
+tls_cert: snakeoil.pem
+tls_key: snakeoil.key
+~~~
+
+~~~{#secret.txt .file}
+secret
+~~~