50 lines
1.9 KiB
Go
50 lines
1.9 KiB
Go
package validation
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestForbiddenFilesUsesCapturedRepositoryPaths(t *testing.T) {
|
|
repository := newTreeRepository(t)
|
|
writeTreeFile(t, repository, "go.mod", []byte("module example.com/root\n"))
|
|
writeTreeFile(t, repository, "nested/go.mod", []byte("module example.com/nested\n"))
|
|
writeTreeFile(t, repository, "nested/token", []byte("fixture-secret\n"))
|
|
writeTreeFile(t, repository, ".gitignore", []byte(".releasekit/\n"))
|
|
gitTree(t, repository, "add", ".")
|
|
gitTree(t, repository, "commit", "-m", "capture a committed credential path")
|
|
commit := strings.TrimSpace(gitTree(t, repository, "rev-parse", "HEAD"))
|
|
writeTreeFile(t, repository, ".releasekit/token", []byte("local-secret\n"))
|
|
if err := os.Remove(filepath.Join(repository, "nested/token")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
installGoShim(t, "", false)
|
|
request := Request{RepositoryDir: repository, Commit: commit}
|
|
if err := Run(context.Background(), request); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request.Settings.ForbiddenFiles = []string{".releasekit/token", "absent-token"}
|
|
if err := Run(context.Background(), request); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request.Settings.ForbiddenFiles = []string{"nested/./token"}
|
|
err := Run(context.Background(), request)
|
|
failure, ok := err.(*Failure)
|
|
if !ok || failure.Check != ForbiddenFiles || len(failure.Findings) != 1 || failure.Findings[0].Path != "nested/token" {
|
|
t.Fatalf("forbidden-files error = %v, want committed nested path despite worktree deletion", err)
|
|
}
|
|
if strings.Contains(err.Error(), "fixture-secret") {
|
|
t.Fatal("validation exposed committed token bytes")
|
|
}
|
|
for _, invalid := range []string{"", "../token", "/token"} {
|
|
request.Settings.ForbiddenFiles = []string{invalid}
|
|
if err := Run(context.Background(), request); err == nil {
|
|
t.Fatalf("invalid path %q was accepted", invalid)
|
|
}
|
|
}
|
|
}
|