43 lines
1.1 KiB
Go
43 lines
1.1 KiB
Go
package api
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"chfs-ng/internal/auth"
|
|
"chfs-ng/internal/storage"
|
|
)
|
|
|
|
func TestCheckDeleteTreeRejectsDeniedDescendant(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.MkdirAll(filepath.Join(root, "public", "private"), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(root, "public", "private", "secret.txt"), []byte("x"), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
store := storage.Local{Root: root}
|
|
account := &auth.Account{Mask: auth.Delete, Rules: []auth.PathRule{{Dir: "public/private", Mask: auth.None}}}
|
|
if err := checkDeleteTree(store, account, "public"); err == nil {
|
|
t.Fatal("expected denied descendant to block recursive deletion")
|
|
}
|
|
}
|
|
|
|
func TestUnsafePath(t *testing.T) {
|
|
cases := map[string]bool{
|
|
"../secret": true,
|
|
"a/../secret": true,
|
|
`..\\secret`: true,
|
|
"%2e%2e/secret": false,
|
|
"secret": false,
|
|
"a//b": false,
|
|
"": false,
|
|
}
|
|
for p, want := range cases {
|
|
if got := unsafePath(p); got != want {
|
|
t.Fatalf("unsafePath(%q)=%v, want %v", p, got, want)
|
|
}
|
|
}
|
|
}
|