Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCC-218: Exclude \"The filename, directory name, or volume label syntax is incorrect\" error during security testing. #350

Merged
merged 2 commits into from
Feb 28, 2024
+2 −0
Merged

OCC-218: Exclude \"The filename, directory name, or volume label syntax is incorrect\" error during security testing. #350

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
18aecbc
Exclude "The filename, directory name, or volume label syntax is inco…
sarahelsaig Feb 28, 2024
76ac871
Permit another benign exception.
sarahelsaig Feb 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Lombiq.Tests.UI/Services/OrchardCoreUITestExecutorConfiguration.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,8 @@ public static Func<IWebApplicationInstance, Task> CreateAppLogAssertionForSecuri
// a directory. Presumably this is an attempt to access protected files using source path manipulation.
// This is handled by ASP.NET Core and there is nothing for us to worry about.
"System.IO.IOException: Not a directory",
"System.IO.IOException: The filename, directory name, or volume label syntax is incorrect",
"System.IO.DirectoryNotFoundException: Could not find a part of the path",
// This happens when a request's model contains a dictionary and a key is missing. While this can be a
// legitimate application error, during a security scan it's more likely the result of an incomplete
// artificially constructed request. So the means the ASP.NET Core model binding is working as intended.
Expand Down
Loading