public_git
/
orchard
mirror of https://github.com/cirruslabs/orchard.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix host directory policy test lint

This commit is contained in:
Fedor Korotkov 2026-08-07 11:02:25 -04:00
parent 57a824621d
commit 2657d8ccb5
1 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
pkg/resource/v1/host_dir_policy_test.go
View File

@ -45,6 +45,11 @@ func TestHostDirPolicyValidate(t *testing.T) {
} }
func TestHostDirPolicyValidatePathBoundary(t *testing.T) { func TestHostDirPolicyValidatePathBoundary(t *testing.T) {
const (
localPathPrefix = "/src/"
githubURLPrefix = "https://github.com"
)
testCases := []struct { testCases := []struct {
name string name string
pathPrefix string pathPrefix string
@ -53,13 +58,13 @@ func TestHostDirPolicyValidatePathBoundary(t *testing.T) {
}{ }{
{ {
name: "local policy allows its exact path", name: "local policy allows its exact path",
pathPrefix: "/src/", pathPrefix: localPathPrefix,
path: "/src", path: "/src",
allowed: true, allowed: true,
}, },
{ {
name: "local policy allows descendants", name: "local policy allows descendants",
pathPrefix: "/src/", pathPrefix: localPathPrefix,
path: "/src/project", path: "/src/project",
allowed: true, allowed: true,
}, },
@ -67,11 +72,13 @@ func TestHostDirPolicyValidatePathBoundary(t *testing.T) {
name: "local policy without trailing slash rejects sibling sharing its prefix", name: "local policy without trailing slash rejects sibling sharing its prefix",
pathPrefix: "/src", pathPrefix: "/src",
path: "/src-private", path: "/src-private",
allowed: false,
}, },
{ {
name: "local policy rejects sibling sharing its prefix", name: "local policy rejects sibling sharing its prefix",
pathPrefix: "/src/", pathPrefix: localPathPrefix,
path: "/src-private", path: "/src-private",
allowed: false,
}, },
{ {
name: "local root policy allows descendants", name: "local root policy allows descendants",
@ -83,33 +90,37 @@ func TestHostDirPolicyValidatePathBoundary(t *testing.T) {
name: "local root policy rejects remote URLs", name: "local root policy rejects remote URLs",
pathPrefix: "/", pathPrefix: "/",
path: "https://github.com/archive.tar.gz", path: "https://github.com/archive.tar.gz",
allowed: false,
}, },
{ {
name: "URL policy allows its exact host", name: "URL policy allows its exact host",
pathPrefix: "https://github.com/", pathPrefix: githubURLPrefix + "/",
path: "https://github.com", path: githubURLPrefix,
allowed: true, allowed: true,
}, },
{ {
name: "URL policy allows paths on its host", name: "URL policy allows paths on its host",
pathPrefix: "https://github.com", pathPrefix: githubURLPrefix,
path: "https://github.com/actions/archive.tar.gz", path: "https://github.com/actions/archive.tar.gz",
allowed: true, allowed: true,
}, },
{ {
name: "URL policy rejects lookalike host", name: "URL policy rejects lookalike host",
pathPrefix: "https://github.com", pathPrefix: githubURLPrefix,
path: "https://github.com.attacker.com/archive.tar.gz", path: "https://github.com.attacker.com/archive.tar.gz",
allowed: false,
}, },
{ {
name: "URL policy with trailing slash rejects lookalike host", name: "URL policy with trailing slash rejects lookalike host",
pathPrefix: "https://github.com/", pathPrefix: githubURLPrefix + "/",
path: "https://github.com.attacker.com/archive.tar.gz", path: "https://github.com.attacker.com/archive.tar.gz",
allowed: false,
}, },
{ {
name: "URL policy rejects host concealed by userinfo", name: "URL policy rejects host concealed by userinfo",
pathPrefix: "https://github.com", pathPrefix: githubURLPrefix,
path: "https://github.com@attacker.example/archive.tar.gz", path: "https://github.com@attacker.example/archive.tar.gz",
allowed: false,
}, },
{ {
name: "URL path policy allows descendants", name: "URL path policy allows descendants",
@ -121,12 +132,13 @@ func TestHostDirPolicyValidatePathBoundary(t *testing.T) {
name: "URL path policy rejects sibling sharing its prefix", name: "URL path policy rejects sibling sharing its prefix",
pathPrefix: "https://github.com/actions", pathPrefix: "https://github.com/actions",
path: "https://github.com/actions-private/archive.tar.gz", path: "https://github.com/actions-private/archive.tar.gz",
allowed: false,
}, },
} }
for _, testCase := range testCases { for _, testCase := range testCases {
t.Run(testCase.name, func(t *testing.T) { t.Run(testCase.name, func(t *testing.T) {
policy := v1.HostDirPolicy{PathPrefix: testCase.pathPrefix} policy := v1.HostDirPolicy{PathPrefix: testCase.pathPrefix, ReadOnly: false}
require.Equal(t, testCase.allowed, policy.Validate(testCase.path, false)) require.Equal(t, testCase.allowed, policy.Validate(testCase.path, false))
}) })