root
62 lines
2.3 KiB
TypeScript
62 lines
2.3 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import path from 'node:path';
|
|
import { resolveWorkspacePath, assertAllowedBinary, SandboxViolationError } from '../sandbox.js';
|
|
|
|
const ROOT = path.resolve('/workspace');
|
|
|
|
describe('resolveWorkspacePath', () => {
|
|
it('resolves a simple relative path inside the root', () => {
|
|
const result = resolveWorkspacePath(ROOT, 'src/index.ts');
|
|
expect(result).toBe(path.join(ROOT, 'src', 'index.ts'));
|
|
});
|
|
|
|
it('resolves "." to the root itself', () => {
|
|
const result = resolveWorkspacePath(ROOT, '.');
|
|
expect(result).toBe(ROOT);
|
|
});
|
|
|
|
it('throws for a single .. escape attempt', () => {
|
|
expect(() => resolveWorkspacePath(ROOT, '../etc/passwd')).toThrow(SandboxViolationError);
|
|
});
|
|
|
|
it('throws for nested .. escape attempts', () => {
|
|
expect(() => resolveWorkspacePath(ROOT, 'a/b/../../../../etc/passwd')).toThrow(SandboxViolationError);
|
|
});
|
|
|
|
it('throws for an absolute path outside the root', () => {
|
|
expect(() => resolveWorkspacePath(ROOT, '/etc/passwd')).toThrow(SandboxViolationError);
|
|
});
|
|
|
|
it('allows a path that walks up and back down inside the root', () => {
|
|
const result = resolveWorkspacePath(ROOT, 'a/b/../c/d.ts');
|
|
expect(result).toBe(path.join(ROOT, 'a', 'c', 'd.ts'));
|
|
});
|
|
});
|
|
|
|
describe('assertAllowedBinary', () => {
|
|
it('allows an explicitly listed binary', () => {
|
|
expect(() => assertAllowedBinary('npm')).not.toThrow();
|
|
expect(() => assertAllowedBinary('php')).not.toThrow();
|
|
expect(() => assertAllowedBinary('docker')).not.toThrow();
|
|
});
|
|
|
|
it('allows listed binaries with common Windows extensions', () => {
|
|
expect(() => assertAllowedBinary('npm.exe')).not.toThrow();
|
|
expect(() => assertAllowedBinary('node.cmd')).not.toThrow();
|
|
expect(() => assertAllowedBinary('composer.ps1')).not.toThrow();
|
|
});
|
|
|
|
it('allows a binary with a directory prefix', () => {
|
|
expect(() => assertAllowedBinary('vendor/bin/phpunit')).not.toThrow();
|
|
});
|
|
|
|
it('rejects a binary not on the allow-list', () => {
|
|
expect(() => assertAllowedBinary('rm')).toThrow(SandboxViolationError);
|
|
expect(() => assertAllowedBinary('curl')).toThrow(SandboxViolationError);
|
|
});
|
|
|
|
it('rejects a path that would execute an arbitrary binary', () => {
|
|
expect(() => assertAllowedBinary('/usr/bin/rm')).toThrow(SandboxViolationError);
|
|
});
|
|
});
|