eric/distributor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

Align bundle path validation coverage

Browse Source
This commit is contained in:
Eric Rakestraw
2026-06-04 00:40:17 +00:00
parent 5a3fd2b8ac
commit 2ac2bbdf79
6 changed files with 146 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
internal/bundle/manifest_test.go
View File

@@ -70,11 +70,19 @@ func TestParseManifestRejectsInvalidDigestFormat(t *testing.T) {
func TestParseManifestRejectsUnsafeFilePaths(t *testing.T) {
tests := []string{
`"path": ""`,
`"path": "."`,
`"path": "./report.md"`,
`"path": "../report.md"`,
`"path": "/report.md"`,
`"path": "nested/../report.md"`,
`"path": "nested/./report.md"`,
`"path": "nested//report.md"`,
`"path": "nested\\report.md"`,
`"path": "manifest.json"`,
`"path": "nested/manifest.json"`,
`"path": "` + storage.StateFileName + `"`,
`"path": "nested/` + storage.StateFileName + `"`,
}
for _, replacement := range tests {
t.Run(replacement, func(t *testing.T) {
@@ -128,6 +136,16 @@ func TestValidateManifestRejectsInvalidManifest(t *testing.T) {
manifest.Digest = BundleDigest(manifest.Files)
return manifest
},
"nested manifest path": func(manifest Manifest) Manifest {
manifest.Files[0].Path = "nested/manifest.json"
manifest.Digest = BundleDigest(manifest.Files)
return manifest
},
"nested state path": func(manifest Manifest) Manifest {
manifest.Files[0].Path = "nested/" + storage.StateFileName
manifest.Digest = BundleDigest(manifest.Files)
return manifest
},
"duplicate path": func(manifest Manifest) Manifest {
manifest.Files[1].Path = manifest.Files[0].Path
manifest.Digest = BundleDigest(manifest.Files)

32
internal/bundle/validate_test.go
View File

@@ -65,6 +65,38 @@ func TestValidateRejectsSymlinkFile(t *testing.T) {
assertErrorContains(t, err, "regular file")
}
func TestValidateRejectsUnsafeManifestPaths(t *testing.T) {
tests := []string{
"",
".",
"./report.md",
"../report.md",
"/report.md",
"nested/../report.md",
"nested/./report.md",
"nested//report.md",
`nested\report.md`,
ManifestName,
storage.StateFileName,
"nested/" + ManifestName,
"nested/" + storage.StateFileName,
}
for _, path := range tests {
t.Run(path, func(t *testing.T) {
backend := validFakeBundle(t)
manifest := validFixtureManifest(t)
manifest.Files[0].Path = path
manifest.Digest = BundleDigest(manifest.Files)
writeManifest(t, backend, manifest)
_, err := Validate(context.Background(), backend, "")
if err == nil {
t.Fatal("Validate() error = nil, want unsafe path error")
}
})
}
}
func validFakeBundle(t *testing.T) *fake.Backend {
t.Helper()
backend := fake.New()