Merge pull request #250 from hashicorp/test-checksum-files

test that arbitrary files cannot be checksummed

Author: CreatorHead

get_test.go

@@ -431,6 +431,13 @@ func TestGetFile_checksum_from_file(t *testing.T) {
 			true,
 			false,
 		},
+
+		// assert arbitrary files will not be read
+		{
+			"?checksum=file:" + checksums + "/multifile-sha1.sum",
+			true,
+			false,
+		},
 	}
 
 	for _, tc := range cases {

testdata/checksum-file/multifile-sha1.sum

@@ -0,0 +1,2 @@
+e2c7dc83ac8aa7f181314387f6dfb132cd117e3a  content.txt
+0000000000000000000000000000000000000000  md5-bsd-bad.sum