54 lines
1.8 KiB
Go
54 lines
1.8 KiB
Go
// Copyright 2026 Alibaba Group
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
package outputguard
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestValidateRejectsHardLinkToProtectedDirectoryMember(t *testing.T) {
|
|
root := t.TempDir()
|
|
protectedDir := filepath.Join(root, "inputs")
|
|
if err := os.MkdirAll(protectedDir, 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
member := filepath.Join(protectedDir, "reviewed.json")
|
|
if err := os.WriteFile(member, []byte(`{}`), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
hardLink := filepath.Join(root, "outside-link.json")
|
|
if err := os.Link(member, hardLink); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err := Validate(root,
|
|
[]Input{{Name: "reviewed directory", Path: "inputs"}},
|
|
[]Target{{Name: "--output", Path: hardLink}},
|
|
)
|
|
if err == nil || !strings.Contains(err.Error(), "hard link to a member") {
|
|
t.Fatalf("Validate() error = %v", err)
|
|
}
|
|
}
|
|
|
|
func TestValidateRepoTargetAllowlist(t *testing.T) {
|
|
root := t.TempDir()
|
|
allowed := filepath.Join(root, "internal/cli/schema_catalog.json")
|
|
if err := os.MkdirAll(filepath.Dir(allowed), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := ValidateRepoTargetAllowlist(root, Target{Name: "--output", Path: allowed}, "internal/cli/schema_catalog.json"); err != nil {
|
|
t.Fatalf("canonical output rejected: %v", err)
|
|
}
|
|
err := ValidateRepoTargetAllowlist(root, Target{Name: "--output", Path: filepath.Join(root, "skills/mono/SKILL.md")}, "internal/cli/schema_catalog.json")
|
|
if err == nil || !strings.Contains(err.Error(), "not a canonical generated delivery target") {
|
|
t.Fatalf("repository source output error = %v", err)
|
|
}
|
|
outside := filepath.Join(t.TempDir(), "catalog.json")
|
|
if err := ValidateRepoTargetAllowlist(root, Target{Name: "--output", Path: outside}, "internal/cli/schema_catalog.json"); err != nil {
|
|
t.Fatalf("external temporary output rejected: %v", err)
|
|
}
|
|
}
|