62 lines
2.1 KiB
Go
62 lines
2.1 KiB
Go
package pathsafe
|
|
|
|
import "testing"
|
|
|
|
func TestValidateOpaqueSegment(t *testing.T) {
|
|
valid := []string{"campaign", "2026-05-03", "run_01", "a.b-c_D9"}
|
|
for _, value := range valid {
|
|
t.Run("valid/"+value, func(t *testing.T) {
|
|
if err := ValidateOpaqueSegment(value); err != nil {
|
|
t.Fatalf("ValidateOpaqueSegment(%q) error = %v", value, err)
|
|
}
|
|
})
|
|
}
|
|
|
|
invalid := []string{"", ".", "..", "campaign/name", `campaign\name`, "/campaign", `C:\campaign`, "campaign name", "café", "campaign\x00name", "campaign\nname"}
|
|
for _, value := range invalid {
|
|
t.Run("invalid", func(t *testing.T) {
|
|
if err := ValidateOpaqueSegment(value); err == nil {
|
|
t.Fatalf("ValidateOpaqueSegment(%q) error = nil, want rejection", value)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func FuzzValidateOpaqueSegment(f *testing.F) {
|
|
for _, seed := range []string{"campaign", "2026-05-03", "..", `C:\campaign`, "café", "a/b", "a\x00b"} {
|
|
f.Add(seed)
|
|
}
|
|
f.Fuzz(func(t *testing.T, value string) {
|
|
if err := ValidateOpaqueSegment(value); err == nil {
|
|
if value == "" || value == "." || value == ".." {
|
|
t.Fatalf("accepted reserved segment %q", value)
|
|
}
|
|
for index := 0; index < len(value); index++ {
|
|
character := value[index]
|
|
if !((character >= 'a' && character <= 'z') || (character >= 'A' && character <= 'Z') ||
|
|
(character >= '0' && character <= '9') || character == '.' || character == '_' || character == '-') {
|
|
t.Fatalf("accepted invalid byte %q in %q", character, value)
|
|
}
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
func FuzzNormalizeRelativeDestination(f *testing.F) {
|
|
for _, seed := range []string{"reports/result.json", `reports\result.json`, "../escape", `C:\escape`, "/absolute", "a/./b", "a/../b"} {
|
|
f.Add(seed)
|
|
}
|
|
f.Fuzz(func(t *testing.T, value string) {
|
|
normalized, err := NormalizeRelativeDestination(value)
|
|
if err != nil {
|
|
return
|
|
}
|
|
if normalized == "" || normalized == "." || normalized == ".." || normalized[0] == '/' {
|
|
t.Fatalf("NormalizeRelativeDestination(%q) = %q, want confined relative path", value, normalized)
|
|
}
|
|
if len(normalized) >= 3 && normalized[:3] == "../" {
|
|
t.Fatalf("NormalizeRelativeDestination(%q) escaped with %q", value, normalized)
|
|
}
|
|
})
|
|
}
|