test

software/proftpd/test/test.py

@@ -151,6 +151,15 @@ class TestSFTPOperations(ProFTPdTestCase):
     # no half uploaded file is kept
     self.assertEqual([], os.listdir(self.upload_dir))
 
+  def test_user_cannot_escape_home(self):
+    with self._getConnection() as sftp:
+      with self.assertRaisesRegexp(IOError, 'Permission denied'):
+        sftp.listdir('..')
+      with self.assertRaisesRegexp(IOError, 'Permission denied'):
+        sftp.listdir('/')
+      with self.assertRaisesRegexp(IOError, 'Permission denied'):
+        sftp.listdir('/tmp/')
+
 
 class TestUserManagement(ProFTPdTestCase):
   def test_user_can_be_added_from_script(self):