eric/distributor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

Align bundle path validation coverage

Browse Source
This commit is contained in:
Eric Rakestraw
2026-06-04 00:40:17 +00:00
parent 5a3fd2b8ac
commit 2ac2bbdf79
6 changed files with 146 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
internal/bundle/manifest_test.go
View File

@@ -70,11 +70,19 @@ func TestParseManifestRejectsInvalidDigestFormat(t *testing.T) {
func TestParseManifestRejectsUnsafeFilePaths(t *testing.T) {
tests := []string{
`"path": ""`,
`"path": "."`,
`"path": "./report.md"`,
`"path": "../report.md"`,
`"path": "/report.md"`,
`"path": "nested/../report.md"`,
`"path": "nested/./report.md"`,
`"path": "nested//report.md"`,
`"path": "nested\\report.md"`,
`"path": "manifest.json"`,
`"path": "nested/manifest.json"`,
`"path": "` + storage.StateFileName + `"`,
`"path": "nested/` + storage.StateFileName + `"`,
}
for _, replacement := range tests {
t.Run(replacement, func(t *testing.T) {
@@ -128,6 +136,16 @@ func TestValidateManifestRejectsInvalidManifest(t *testing.T) {
manifest.Digest = BundleDigest(manifest.Files)
return manifest
},
"nested manifest path": func(manifest Manifest) Manifest {
manifest.Files[0].Path = "nested/manifest.json"
manifest.Digest = BundleDigest(manifest.Files)
return manifest
},
"nested state path": func(manifest Manifest) Manifest {
manifest.Files[0].Path = "nested/" + storage.StateFileName
manifest.Digest = BundleDigest(manifest.Files)
return manifest
},
"duplicate path": func(manifest Manifest) Manifest {
manifest.Files[1].Path = manifest.Files[0].Path
manifest.Digest = BundleDigest(manifest.Files)