apply code review and also catch "." as username

This commit is contained in:
holger krekel
2024-07-09 18:46:37 +02:00
parent a1f0a3e23b
commit 0d593c22d1
2 changed files with 13 additions and 3 deletions

View File

@@ -38,9 +38,11 @@ class Config:
return open(self._inipath, "rb")
def get_user_maildir(self, addr):
if not addr or "/" in addr:
raise ValueError(addr)
return self.mail_basedir.joinpath(addr)
if addr and addr != "." and "/" not in addr:
res = self.mail_basedir.joinpath(addr).resolve()
if res.is_relative_to(self.mail_basedir):
return res
raise ValueError(f"invalid address {addr!r}")
def write_initial_config(inipath, mail_domain):

View File

@@ -43,7 +43,15 @@ def test_get_user_maildir(make_config):
with pytest.raises(ValueError):
config.get_user_maildir("")
with pytest.raises(ValueError):
config.get_user_maildir(None)
with pytest.raises(ValueError):
config.get_user_maildir("../some@something.testrun.org")
with pytest.raises(ValueError):
config.get_user_maildir("..")
with pytest.raises(ValueError):
config.get_user_maildir(".")