41 lines
1.4 KiB
Go
41 lines
1.4 KiB
Go
package artifacts
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestEnsureLayoutForRejectsUnsafeIdentityBeforeFilesystemAccess(t *testing.T) {
|
|
workspace := t.TempDir()
|
|
store := NewLocalStore(workspace)
|
|
for _, identity := range []struct {
|
|
name string
|
|
campaign string
|
|
session string
|
|
}{
|
|
{name: "campaign traversal", campaign: "../outside", session: "session"},
|
|
{name: "session separator", campaign: "campaign", session: `session\other`},
|
|
{name: "session drive", campaign: "campaign", session: `C:\outside`},
|
|
{name: "unicode", campaign: "café", session: "session"},
|
|
} {
|
|
t.Run(identity.name, func(t *testing.T) {
|
|
if _, err := store.EnsureLayoutFor(identity.campaign, identity.session); err == nil {
|
|
t.Fatal("EnsureLayoutFor() error = nil, want unsafe identity rejection")
|
|
}
|
|
if _, err := os.Stat(filepath.Join(workspace, "work")); !os.IsNotExist(err) {
|
|
t.Fatalf("workspace path was created for rejected identity, stat err = %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSessionPreviousArtifactPathRejectsEscapingRelativePath(t *testing.T) {
|
|
paths := buildSessionPaths(t.TempDir(), "campaign", "session")
|
|
for _, relative := range []string{"../escape.json", "/absolute.json", `C:\escape.json`} {
|
|
if _, err := SessionPreviousArtifactPath(paths, relative); err == nil {
|
|
t.Fatalf("SessionPreviousArtifactPath(%q) error = nil, want confinement failure", relative)
|
|
}
|
|
}
|
|
}
|