Initial Dever 0.0.1

test/rust/native/dependency/archive.rs

@@ -0,0 +1,78 @@
+use super::fixture::{Fixture, app};
+
+#[test]
+fn archives_reject_traversal_foreign_components_and_file_directory_conflicts() {
+    for (path, needle) in [
+        ("module/numbers/../escape", "unsafe"),
+        ("/module/numbers/escape", "unsafe"),
+        ("module/numbers//escape", "unsafe"),
+        ("module/numbers/./escape", "unsafe"),
+        ("module/numbers/a\\b", "unsafe"),
+        ("module/numbers/C:escape", "unsafe"),
+        ("module/other/value/app.dever", "unowned"),
+        ("config/setting.json", "unowned"),
+        ("module/numbers/value", "file/directory conflict"),
+    ] {
+        let mut fixture = Fixture::new(&["numbers@*"]);
+        fixture.package(
+            "numbers",
+            &[],
+            &[
+                ("module/numbers/value/app.dever", &app("input")),
+                (path, "unowned or unsafe"),
+            ],
+        );
+        fixture.reject(needle);
+    }
+}
+
+#[test]
+fn archives_reject_duplicate_central_paths_even_when_zip_library_coalesces_them() {
+    let mut fixture = Fixture::new(&["numbers@*"]);
+    fixture.package(
+        "numbers",
+        &[],
+        &[
+            ("module/numbers/value/app.dever", &app("input")),
+            ("module/numbers/assets/first", "same"),
+            ("module/numbers/assets/other", "same"),
+        ],
+    );
+    fixture.mutate_archive("numbers", |bytes| {
+        let mut cursor = 0;
+        while cursor + 5 <= bytes.len() {
+            if &bytes[cursor..cursor + 5] == b"other" {
+                bytes[cursor..cursor + 5].copy_from_slice(b"first");
+            }
+            cursor += 1;
+        }
+    });
+    fixture.reject("duplicate or inconsistent");
+}
+
+#[test]
+fn archives_reject_symlinks_and_oversized_expansion_before_reading_contents() {
+    for (link, needle) in [(true, "link or unsupported"), (false, "expanded size")] {
+        let mut fixture = Fixture::new(&["numbers@*"]);
+        fixture.package(
+            "numbers",
+            &[],
+            &[("module/numbers/value/app.dever", &app("input"))],
+        );
+        fixture.mutate_archive("numbers", |bytes| {
+            let central = bytes
+                .windows(4)
+                .position(|header| header == b"PK\x01\x02")
+                .unwrap();
+            if link {
+                bytes[central + 5] = 3;
+                bytes[central + 38..central + 42]
+                    .copy_from_slice(&(0o120777_u32 << 16).to_le_bytes());
+            } else {
+                bytes[central + 24..central + 28]
+                    .copy_from_slice(&(256_u32 * 1024 * 1024 + 1).to_le_bytes());
+            }
+        });
+        fixture.reject(needle);
+    }
+}