Files
Cyrene_v2/internal/runtime/exec/sandbox_test.go
T

55 lines
1.4 KiB
Go

package exec
import (
"path/filepath"
"testing"
)
// TestWithinAnyRoot covers lexical containment (filepath.Rel based).
func TestWithinAnyRoot(t *testing.T) {
t.Parallel()
root := filepath.Clean("/allow/root")
cases := []struct {
name string
path string
want bool
}{
{"inside", filepath.Join(root, "a", "b.txt"), true},
{"exact-root", root, true},
{"parent", filepath.Dir(root), false},
{"sibling", "/allow/other", false},
{"sibling-prefix", "/allow/root-other", false},
{"deep", filepath.Join(root, "x", "y", "z"), true},
{"empty-sub", filepath.Join(root, "sub", "..", "file.txt"), true},
}
for _, c := range cases {
c := c
t.Run(c.name, func(t *testing.T) {
t.Parallel()
if got := withinAnyRoot(c.path, []string{root}); got != c.want {
t.Errorf("withinAnyRoot(%q) = %v, want %v", c.path, got, c.want)
}
})
}
}
// TestResolveReal_NonExistentNested resolves a path whose leaf components do not
// exist yet, walking up to the deepest existing ancestor.
func TestResolveReal_NonExistentNested(t *testing.T) {
t.Parallel()
dir := t.TempDir()
realDir := dir
if r, err := filepath.EvalSymlinks(dir); err == nil {
realDir = r
}
p := filepath.Join(dir, "a", "b", "c")
got, err := resolveReal(p)
if err != nil {
t.Fatalf("resolveReal(%q) error: %v", p, err)
}
want := filepath.Join(realDir, "a", "b", "c")
if got != want {
t.Errorf("resolveReal = %q, want %q", got, want)
}
}