use super::fixture::{Fixture, app}; #[test] fn archives_reject_traversal_foreign_components_and_file_directory_conflicts() { for (path, needle) in [ ("module/numbers/../escape", "unsafe"), ("/module/numbers/escape", "unsafe"), ("module/numbers//escape", "unsafe"), ("module/numbers/./escape", "unsafe"), ("module/numbers/a\\b", "unsafe"), ("module/numbers/C:escape", "unsafe"), ("module/other/value/app.dever", "unowned"), ("config/setting.json", "unowned"), ("module/numbers/value", "file/directory conflict"), ] { let mut fixture = Fixture::new(&["numbers@*"]); fixture.package( "numbers", &[], &[ ("module/numbers/value/app.dever", &app("input")), (path, "unowned or unsafe"), ], ); fixture.reject(needle); } } #[test] fn archives_reject_duplicate_central_paths_even_when_zip_library_coalesces_them() { let mut fixture = Fixture::new(&["numbers@*"]); fixture.package( "numbers", &[], &[ ("module/numbers/value/app.dever", &app("input")), ("module/numbers/assets/first", "same"), ("module/numbers/assets/other", "same"), ], ); fixture.mutate_archive("numbers", |bytes| { let mut cursor = 0; while cursor + 5 <= bytes.len() { if &bytes[cursor..cursor + 5] == b"other" { bytes[cursor..cursor + 5].copy_from_slice(b"first"); } cursor += 1; } }); fixture.reject("duplicate or inconsistent"); } #[test] fn archives_reject_symlinks_and_oversized_expansion_before_reading_contents() { for (link, needle) in [(true, "link or unsupported"), (false, "expanded size")] { let mut fixture = Fixture::new(&["numbers@*"]); fixture.package( "numbers", &[], &[("module/numbers/value/app.dever", &app("input"))], ); fixture.mutate_archive("numbers", |bytes| { let central = bytes .windows(4) .position(|header| header == b"PK\x01\x02") .unwrap(); if link { bytes[central + 5] = 3; bytes[central + 38..central + 42] .copy_from_slice(&(0o120777_u32 << 16).to_le_bytes()); } else { bytes[central + 24..central + 28] .copy_from_slice(&(256_u32 * 1024 * 1024 + 1).to_le_bytes()); } }); fixture.reject(needle); } }