25 lines
1.1 KiB
TypeScript
25 lines
1.1 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { secureExistingPath, secureFuturePath } from "../src/paths";
|
|
|
|
test("canonical path guard rejects traversal and symlink escapes", async () => {
|
|
const parent = await mkdtemp(join(tmpdir(), "pom-paths-"));
|
|
const root = join(parent, "project");
|
|
const outside = join(parent, "outside.txt");
|
|
await mkdir(root);
|
|
await writeFile(join(root, "inside.txt"), "safe");
|
|
await writeFile(outside, "secret");
|
|
await symlink(outside, join(root, "escape.txt"));
|
|
try {
|
|
assert.equal(await secureExistingPath(root, "inside.txt"), join(root, "inside.txt"));
|
|
await assert.rejects(secureExistingPath(root, "../outside.txt"), /escapes project root/);
|
|
await assert.rejects(secureExistingPath(root, "escape.txt"), /Symbolic links/);
|
|
await assert.rejects(secureFuturePath(root, "../future.txt"), /escapes project root/);
|
|
} finally {
|
|
await rm(parent, { recursive: true, force: true });
|
|
}
|
|
});
|