diff --git a/swh/web/ui/tests/test_app.py b/swh/web/ui/tests/test_app.py
index c02e0d424..fbd1e470d 100644
--- a/swh/web/ui/tests/test_app.py
+++ b/swh/web/ui/tests/test_app.py
@@ -1,52 +1,53 @@
 # Copyright (C) 2015  The Software Heritage developers
 # See the AUTHORS file at the top-level directory of this distribution
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
 # Functions defined here are NOT DESIGNED FOR PRODUCTION
 
 
 from swh.web.ui import controller
 from swh.storage.api.client import RemoteStorage as Storage
 
 
 # Because the Storage's __init__ function does side effect at startup...
 class RemoteStorageAdapter(Storage):
     def __init__(self, base_url):
         self.base_url = base_url
 
 
 def _init_mock_storage():
     """Instanciate a remote storage whose goal is to be mocked in a test
     context.
 
     NOT FOR PRODUCTION
 
     Returns:
         An instance of swh.storage.api.client.RemoteStorage destined to be
         mocked (it does not do any rest call)
 
     """
     return RemoteStorageAdapter('http://somewhere.org:4321/')  # Mock
 
 
 def init_app():
     """Function to initiate a flask app with storage designed to be mocked.
 
     Returns:
         Tuple app and storage.
 
     NOT FOR PRODUCTION
 
     """
     storage = _init_mock_storage()
 
     # inject the mock data
     conf = {'api_backend': 'https://somewhere.org:4321',
-            'storage': storage}
+            'storage': storage,
+            'upload_folder': '/some/upload-dir'}
 
     controller.app.config['TESTING'] = True
     controller.app.config.update({'conf': conf})
     app = controller.app.test_client()
 
     return app, storage
diff --git a/swh/web/ui/tests/test_upload.py b/swh/web/ui/tests/test_upload.py
index 55d9ad5c7..c7b1f846b 100644
--- a/swh/web/ui/tests/test_upload.py
+++ b/swh/web/ui/tests/test_upload.py
@@ -1,59 +1,94 @@
 # Copyright (C) 2015  The Software Heritage developers
 # See the AUTHORS file at the top-level directory of this distribution
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
 import unittest
 
 from nose.tools import istest
+from unittest.mock import patch
 
 from swh.web.ui import upload
 from swh.web.ui.tests import test_app
 
 
 class UploadTestCase(unittest.TestCase):
     @classmethod
     def setUpClass(cls):
         cls.app, cls.storage = test_app.init_app()
 
     @istest
     def allowed_file_ok(self):
         # when
         actual_perm = upload.allowed_file('README')
         self.assertTrue(actual_perm)
 
         # when
         actual_perm2 = upload.allowed_file('README', [])
         self.assertTrue(actual_perm2)
 
         # when
         actual_perm3 = upload.allowed_file('README', ['README',
                                                       'LICENCE',
                                                       'BUGS'])
         self.assertTrue(actual_perm3)
 
         # when
         actual_perm4 = upload.allowed_file('some-filename.txt', ['txt',
                                                                  'blah',
                                                                  'gz'])
         self.assertTrue(actual_perm4)
 
         # when
         actual_perm5 = upload.allowed_file('something.tar.gz', ['gz',
                                                                 'txt',
                                                                 'tar.gz'])
         # then
         self.assertTrue(actual_perm5)
 
     @istest
     def allowed_file_denied(self):
         # when
         actual_perm = upload.allowed_file('some-filename', ['blah'])
         self.assertFalse(actual_perm)
 
         # when
         actual_perm = upload.allowed_file('something.tgz', ['gz',
                                                             'txt',
                                                             'tar.gz'])
         # then
         self.assertFalse(actual_perm)
+
+    @patch('swh.web.ui.upload.os.path')
+    @patch('swh.web.ui.upload.shutil')
+    @istest
+    def cleanup_ok(self, mock_shutil, mock_os_path):
+        # given
+        mock_os_path.commonprefix.return_value = '/some/upload-dir'
+        mock_shutil.rmtree.return_value = True
+
+        # when
+        upload.cleanup('/some/upload-dir/some-dummy-path')
+
+        # then
+        mock_os_path.commonprefix.assert_called_with(
+            ['/some/upload-dir', '/some/upload-dir/some-dummy-path'])
+        mock_shutil.rmtree.assert_called_with(
+            '/some/upload-dir/some-dummy-path')
+
+    @patch('swh.web.ui.upload.os.path')
+    @patch('swh.web.ui.upload.shutil')
+    @istest
+    def cleanup_should_fail(self, mock_shutil, mock_os_path):
+        # given
+        mock_os_path.commonprefix.return_value = '/somewhere/forbidden'
+        mock_shutil.rmtree.return_value = True
+
+        # when
+        with self.assertRaises(AssertionError):
+            upload.cleanup('/some/upload-dir/some-dummy-path')
+
+        # then
+        mock_os_path.commonprefix.assert_called_with(
+            ['/some/upload-dir', '/some/upload-dir/some-dummy-path'])
+        self.assertTrue(mock_shutil.rmtree.not_called)