Validate portable workspace identifiers

internal/artifacts/identity_paths_test.go

@@ -0,0 +1,40 @@
+package artifacts
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEnsureLayoutForRejectsUnsafeIdentityBeforeFilesystemAccess(t *testing.T) {
+	workspace := t.TempDir()
+	store := NewLocalStore(workspace)
+	for _, identity := range []struct {
+		name     string
+		campaign string
+		session  string
+	}{
+		{name: "campaign traversal", campaign: "../outside", session: "session"},
+		{name: "session separator", campaign: "campaign", session: `session\other`},
+		{name: "session drive", campaign: "campaign", session: `C:\outside`},
+		{name: "unicode", campaign: "café", session: "session"},
+	} {
+		t.Run(identity.name, func(t *testing.T) {
+			if _, err := store.EnsureLayoutFor(identity.campaign, identity.session); err == nil {
+				t.Fatal("EnsureLayoutFor() error = nil, want unsafe identity rejection")
+			}
+			if _, err := os.Stat(filepath.Join(workspace, "work")); !os.IsNotExist(err) {
+				t.Fatalf("workspace path was created for rejected identity, stat err = %v", err)
+			}
+		})
+	}
+}
+
+func TestSessionPreviousArtifactPathRejectsEscapingRelativePath(t *testing.T) {
+	paths := buildSessionPaths(t.TempDir(), "campaign", "session")
+	for _, relative := range []string{"../escape.json", "/absolute.json", `C:\escape.json`} {
+		if _, err := SessionPreviousArtifactPath(paths, relative); err == nil {
+			t.Fatalf("SessionPreviousArtifactPath(%q) error = nil, want confinement failure", relative)
+		}
+	}
+}