zopefoundation / Zope

82%

master: 82%

LAST BUILD ON BRANCH fix-traversal-up-past-root

branch: fix-traversal-up-past-root

CHANGE BRANCH

x

Reset

• fix-traversal-up-past-root
• #1109-doc-ja-translation
• #1109-docs-ja-translation
• 372-mkwsgiinstance-zope2path-text
• 4-AccessControl-4.4
• 4-update-restricted-Python
• 4.0
• 4.0b10
• 4.0b4
• 4.0b5
• 4.0b6
• 4.0b7
• 4.0b8
• 4.0b8.dev1
• 4.0b9
• 4.1
• 4.1.1
• 4.1.2
• 4.1.3
• 4.2
• 4.2.1
• 4.3
• 4.4
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.5.1
• 4.5.2
• 4.5.3
• 4.8.10
• 4.8.10.x
• 4.8.11
• 4.8.8
• 4.8.9
• 4.x
• 4.x-fix-path-of-extensions
• 4.x-max-version
• 5.0
• 5.0a1
• 5.0a2
• 5.1
• 5.10
• 5.11
• 5.11.1
• 5.12
• 5.2.1
• 5.3
• 5.4
• 5.5.1
• 5.5.2
• 5.6
• 5.7
• 5.7.1
• 5.7.2
• 5.7.3
• 5.8
• 5.8.1
• 5.8.2
• 5.8.3
• 5.8.4
• 5.8.5
• 5.9
• 674-raise
• 674-update-comment
• 674-update-comment-4.x
• 829-fix-debugError
• 829-fix-debugError-4.x
• 829-fix-debugError-safer
• 829-fix-debugError-take-2
• AccessControl-6.2
• DTMLMethod-content-conversion
• ExtensionClass/4.6
• ExtensionClass_Base_as_object
• FieldStorage
• HTTPRequest_search_type#511
• IZopeAwareEngine#864
• Issue594
• OFS_avoid_direct_id_access#903
• PermissionsDocument
• RestrictedPython-alpha
• StringExpr__bytes_2_text#plone3145
• ZPublisher_body+qs
• accesscontrol-4.1
• add_app_to_product_context
• all-repos_autofix_all-repos-sed
• argument-conversion
• avoid_unsolicited_translations#876
• bugfix/708
• buildout-3.1.0
• builtins_in_PathExpr#863
• bytes_response_header#930
• chameleon_tales_path_expr
• chameleon_zope_context_wrapping
• charset_x-www-form-urlencod
• config-with-zope-product
• config-with-zope-product-template-13b9049c
• config-with-zope-product-template-15e6a5a9
• config-with-zope-product-template-5128b943
• config-with-zope-product-template-5a4d3a13
• config-with-zope-product-template-6cd77955
• config-with-zope-product-template-6f8d8c51
• config-with-zope-product-template-74a0f0f2
• config-with-zope-product-template-857123fa
• config-with-zope-product-template-994c74d7
• config-with-zope-product-template-a085e159
• config-with-zope-product-template-b21fbbf2
• config-with-zope-product-template-c09aa986
• config-with-zope-product-template-cb0568c7
• config-with-zope-product-template-fcc582ea
• content_length
• control_internal_xmlrpc
• coverage
• current-version
• current-versions
• dataflake/better_zmi_debugging
• dataflake/codeql1
• dataflake/define-custom-mimetypes
• dataflake/deps_update_sphinx_theme_change
• dataflake/drop-scripts
• dataflake/fix_deprecations
• dataflake/issue_1130
• dataflake/issue_997
• dataflake/issue_997_2
• dataflake/proxyrole_and_managers
• dataflake/reinstate_tempstorage
• dataflake/spamrequests
• dataflake/specific_mo_ignore
• dataflake/try_macos
• dataflake/url_audit
• dataflake/version-specifier-fix
• dataflake/versions_cleanup
• dataflake/zmi_came_from
• delete-outdated-outline
• delete-unused-variables
• dependabot/pip/cryptography-3.2
• dependabot/pip/restrictedpython-7.3
• dependabot/pip/restrictedpython-8.0
• dependabot/pip/waitress-1.4.2
• dependabot/pip/waitress-2.1.1
• dependabot/pip/waitress-3.0.1
• dependabot/pip/webob-1.8.8
• deprecated_splitport_splittype
• dev_guide_getting_started
• disable_ZCatalog_performance_test
• djay-handle-badrequests
• djay-traverse_badreqests
• do_not_cache_form_cookie_lookups#630
• docs-ja-fix_typo-20230402
• docs-ja-translation-#1111
• docs_zmi
• document_site_error_log
• document_tempstorage_replacement
• documenttemplate-31-4x
• documenttemplate-31-master
• dos_documentation
• dos_param_config
• drop-bootstrap.py
• drop-history
• drop-python2-support
• drop-python2-support-part-2
• drop-python2-support-part-3
• drop-python2-support-part-4
• drop-python2-support-part-5
• drop-some-subsections
• drop-zserver-support
• drop_python_36
• dwt-better-session-documentation
• ecosystem
• enforce_conventions
• ensure_native_string_response_header#905
• error_log-request_param_exception
• exclude_special_interpolation_chars#925
• extract_media_type
• fix-1051
• fix-1188-zope-testrunner
• fix-217
• fix-287
• fix-308
• fix-321
• fix-368
• fix-385
• fix-452
• fix-797
• fix-801
• fix-FileUpload
• fix-Pdata-conversion
• fix-ZCacheable_getModTime
• fix-converter-basics
• fix-cookie-leading-dot
• fix-doctest
• fix-dtml-upload
• fix-five-site-view
• fix-flake8
• fix-formatting-for-changes-file
• fix-gunicorn-post-requests
• fix-isort
• fix-issue-with-plone.restapi
• fix-lint
• fix-linting
• fix-marshalling-section
• fix-max-version
• fix-minor-glitches
• fix-mkwsgiinstance
• fix-non-ascii-in-url
• fix-path-of-extensions
• fix-plone.app.folder
• fix-redirect-@-quoting
• fix-retry-close-request
• fix-rtd
• fix-setBody-tuple
• fix-str-bytes-confusion-on-dtml-add
• fix-typo
• fix-typos
• fix-versions-py37
• fix-xml-page-template
• fix-zconsole-namespaces
• fix_1172
• fix_524
• fix_BODY_limit
• fix_ZODB_issue_208
• fix_appveyor
• fix_breadcrumbs
• fix_buildout_after_tempstorage_removal
• fix_content_types
• fix_cookie_setting
• fix_deprecation_resource_warnings
• fix_form_part_limit
• fix_notify_when_not_retrying
• fix_ofs_svg_dims
• fix_ofs_svg_dims2
• fix_propertysheet_get
• fix_repeat_variable_length#913
• fix_typos
• fix_wheel_version
• fix_whitespace
• fixdoc_request_lookup_order#629
• fixes4plone+archetypes-4.x
• fixzminonrootdeployments
• flake8-via-pre-commit
• format_docstrings
• forms_like_multipart
• forward-port#1000
• forward_port#1032
• forward_port#1097
• forward_port#839__template_exception_info#837
• forward_port_1010
• forward_port_905
• ftp-security-declarations
• get_rid_of_xwsgi_throw_errors
• gforcada-patch-1
• gforcada-patch-1-1
• gotcha-patch-1
• http_header_encoding
• icemac-patch-1
• image-tag
• improve-exception-documentation
• improve-formatting
• improve-section-publishing-methods
• improve_pip_docs
• improve_unicode_conflict_resolution
• improve_virtualenv_documentation_
• improved_avoid_unsolicited_translations#876
• include-zmi.styles
• issue-841/f-strings
• issue717-pttales-4.x
• issue717-pttales-master
• issue717_4.x
• issue_1006
• issue_210
• issue_216
• issue_238
• issue_26_errorlog_zmi
• issue_29
• issue_291
• issue_313
• issue_391
• issue_397
• issue_397_http-401
• issue_401
• issue_406
• issue_413
• issue_42
• issue_434
• issue_449
• issue_450
• issue_451
• issue_457
• issue_479
• issue_482
• issue_489
• issue_490
• issue_492
• issue_516
• issue_531
• issue_535
• issue_537
• issue_548
• issue_562
• issue_571
• issue_580
• issue_591
• issue_623
• issue_659
• issue_671
• issue_683
• issue_692
• issue_703
• issue_714
• issue_715
• issue_730
• issue_730b
• issue_755
• issue_846
• issue_846_2
• issue_854
• issue_890
• issue_962
• item_w__name__#903
• jens_clean_tests
• jens_fix_341
• jens_fix_357
• jensens-adduser-config
• jensens-patch-1
• jensens/update-chameleon-version
• json_converter
• jugmac00-extend-ecosystem.cfg
• jugmac00-fix-another-typo
• jugmac00-fix-formatting
• jugmac00-fix-some-typos
• jugmac00-fix-two-typos
• jugmac00-fix-typo
• jugmac00-fix-typos
• jugmac00-object-publishing-update-introduction
• jugmac00-patch-1
• jugmac00-patch-2
• jugmac00-patch-3
• jugmac00-patch-4
• jugmac00-travis-ci-remove-sudo-tag
• jugmac00-update-object-publisher-documentation-http-publishing
• keep_existing_loggers_pr
• lines-property
• log-warning
• logo-facelift
• logo_license
• lost_variables#860
• mapply_signature
• master
• master_repeat_item_iterable#913
• maurits-accept-but-ignore-charset-for-x-www-form-urlencoded
• maurits-cleanup-ulines
• maurits-ensure-publishable
• maurits-exception-content-type-header-master
• maurits-fileupload-charset-latin-1
• maurits-fix-unicode-properties
• maurits-getZMIMainFrameTarget-tainted
• maurits-harden-zmi-frame-4x
• maurits-image-svg-download-4x
• maurits-issue-270-improve-fix-unicode-properties
• maurits-more-minor-version-upgrades
• maurits-new-versions-20221212
• maurits-sources-from-git-to-https-master
• maurits-three-updated-packages
• maurits-update-changelog
• maurits-update-versions-2023-03-15
• maurits-zope-i18n-480
• maurits/update-master-versions-based-on-4x
• maurits/zodbupdate15-4x
• maurits/zope-4x-documenttemplate-3x
• minor-fixes
• modernize_product_enumeration
• modernize_request_parms#641
• more-pre-commit
• move_LockItem_with_zodbupdate
• new-setuptools-support
• new-versions
• ofs_handle_svg_images
• perrinjerome/close-file-upload
• perrinjerome/file-history
• perrinjerome/fix-zmi-user-path
• perrinjerome/macosxfails
• perrinjerome/macosxfails2
• perrinjerome/new-cache
• pip_install_use_constraints
• pipenv
• plone-py3
• port#1053_to_master
• pre-commit
• pre-commit-1
• prepare-zope-5
• pull_933
• py311
• py311-final
• py312
• py313
• py38
• py39
• py3_fix_wsgi_unauthorized
• pylint
• python33-dependencies
• re-240-fix-manage-file
• re-309-manage_menu-db
• re-316-broken-zsqlmethod-addItem
• re-327-fix-addItem
• re-345-appveyor
• re-379-revert-repr
• re-575-path_info
• re-734-Paste-missing
• re279-ordered-folders
• readme_spacing
• record-arguments
• remote-references-to-ftp
• remove-doc-about-ftp-webdav
• remove-typing-pin
• remove-unneeded-if
• remove-unused-variable
• remove_environemnt_var
• remove_profile
• remove_recomendation_of_tempstorage
• remove_unused_conflict_error_import
• remove_z_realm
• request_params#636
• restore_debuginfo
• revert-1142-dos_param_config
• revert-1172-content_length
• revert-1208
• revise-ObjectPublishing-continued
• revise-basic-publisher-security
• revise-character-encoding-for-responses
• revise-exceptions-and-transactions
• revise-marshalling
• revise-method-arguments
• revise-section-character-encodings
• revise-section-exceptions
• revise-section-request
• revise_traversal_methods_section
• revive_history
• roadmap
• roto-bump-travis-py38-to-stable
• roto-drop-bci-headers
• run-pyupgrade-via-pre-commit
• run_scripts_debug_console
• scripts-once
• set_p_repr
• simplify-buildout-installation-document
• small-optimization
• start-revsing-zope-products
• structure_expression
• support-python3.9
• tainting_#1095
• template_exception_info#837
• template_test_cleanup
• test_tal_switch_#862
• thet-jsonrequest
• tox-pip
• traversal-security
• traversal_interfaces
• unicode-commit-message
• unicode-object-id
• unicode-sorting
• unspecified_file_parameter
• update-base-href
• update-components-documentation
• update-deps
• update-news-regarding-webdav
• update-persistent
• update-record-documentation
• update-section-http-response
• update-traversal-and-acquisition
• update-zcatalog-docu
• update-zdg
• update-zodbpy2topy3-migratio-guide
• update-zope-interface-6.3
• updateRestrictedPython
• update_releases
• update_webserver_paragraph
• use-getattr
• version_txt
• waitress-212
• webdav
• webdav_4x
• webdav_part_2
• what-is-py38
• wilkes/397-allowed-attributes
• windows-ci-gha
• windows-gha
• workaround_CMFCore_design_bug
• wsgi_content_length
• wsgi_show_tb_pr
• xmlrpc
• zcatalog-6.3
• zdg_object_publishing
• zmi-add-fix-#505+#506
• zmi-bootstrap
• zmi-fix-broken-objects
• zmi_chromium_cssbug
• zmi_copyright_page
• zmi_davlock
• zmi_debuginfo
• zmi_description_not_absolute
• zmi_update_ace
• zmi_version
• zmi_whitespace_cleanup
• zodb-mount-points-as-native-strings
• zodbupdate
• zope
• zope-5
• zope-security
• zope.interface-5.1.1
• zope.interface-5.1.1-4.x
• zope.interface-7.2
• zope.untrustedpython
• zope_dev_guide_252
• zope_test_on_appveyor
• zopeini_backslash
• zpublish

Build # 9486257962

Build Type

push

github

Committed by davisagli

Commit Message

Return 404 instead of IndexError for traversal past the root

Run Details

4264 of 6886 branches covered (61.92%)

Branch coverage included in aggregate %.

12 of 12 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

28013 of 32348 relevant lines covered (86.6%)

0.87 hits per line