79 lines
2.6 KiB
Rust
79 lines
2.6 KiB
Rust
use super::fixture::{Fixture, app};
|
|
|
|
#[test]
|
|
fn archives_reject_traversal_foreign_components_and_file_directory_conflicts() {
|
|
for (path, needle) in [
|
|
("module/numbers/../escape", "unsafe"),
|
|
("/module/numbers/escape", "unsafe"),
|
|
("module/numbers//escape", "unsafe"),
|
|
("module/numbers/./escape", "unsafe"),
|
|
("module/numbers/a\\b", "unsafe"),
|
|
("module/numbers/C:escape", "unsafe"),
|
|
("module/other/value/app.dever", "unowned"),
|
|
("config/setting.json", "unowned"),
|
|
("module/numbers/value", "file/directory conflict"),
|
|
] {
|
|
let mut fixture = Fixture::new(&["numbers@*"]);
|
|
fixture.package(
|
|
"numbers",
|
|
&[],
|
|
&[
|
|
("module/numbers/value/app.dever", &app("input")),
|
|
(path, "unowned or unsafe"),
|
|
],
|
|
);
|
|
fixture.reject(needle);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn archives_reject_duplicate_central_paths_even_when_zip_library_coalesces_them() {
|
|
let mut fixture = Fixture::new(&["numbers@*"]);
|
|
fixture.package(
|
|
"numbers",
|
|
&[],
|
|
&[
|
|
("module/numbers/value/app.dever", &app("input")),
|
|
("module/numbers/assets/first", "same"),
|
|
("module/numbers/assets/other", "same"),
|
|
],
|
|
);
|
|
fixture.mutate_archive("numbers", |bytes| {
|
|
let mut cursor = 0;
|
|
while cursor + 5 <= bytes.len() {
|
|
if &bytes[cursor..cursor + 5] == b"other" {
|
|
bytes[cursor..cursor + 5].copy_from_slice(b"first");
|
|
}
|
|
cursor += 1;
|
|
}
|
|
});
|
|
fixture.reject("duplicate or inconsistent");
|
|
}
|
|
|
|
#[test]
|
|
fn archives_reject_symlinks_and_oversized_expansion_before_reading_contents() {
|
|
for (link, needle) in [(true, "link or unsupported"), (false, "expanded size")] {
|
|
let mut fixture = Fixture::new(&["numbers@*"]);
|
|
fixture.package(
|
|
"numbers",
|
|
&[],
|
|
&[("module/numbers/value/app.dever", &app("input"))],
|
|
);
|
|
fixture.mutate_archive("numbers", |bytes| {
|
|
let central = bytes
|
|
.windows(4)
|
|
.position(|header| header == b"PK\x01\x02")
|
|
.unwrap();
|
|
if link {
|
|
bytes[central + 5] = 3;
|
|
bytes[central + 38..central + 42]
|
|
.copy_from_slice(&(0o120777_u32 << 16).to_le_bytes());
|
|
} else {
|
|
bytes[central + 24..central + 28]
|
|
.copy_from_slice(&(256_u32 * 1024 * 1024 + 1).to_le_bytes());
|
|
}
|
|
});
|
|
fixture.reject(needle);
|
|
}
|
|
}
|