-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Make sure DirectoryPathTree does not allow reading outside the root dir
- Loading branch information
1 parent
35f1bd3
commit 9ac9675
Showing
9 changed files
with
374 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
166 changes: 166 additions & 0 deletions
166
...nt-projects/bootstrap/app-model/src/test/java/io/quarkus/paths/DirectoryPathTreeTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,166 @@ | ||
| package io.quarkus.paths; | ||
|
|
||
| import static org.assertj.core.api.Assertions.assertThat; | ||
| import static org.junit.jupiter.api.Assertions.fail; | ||
|
|
||
| import java.io.IOException; | ||
| import java.io.UncheckedIOException; | ||
| import java.net.URL; | ||
| import java.nio.file.Files; | ||
| import java.nio.file.Path; | ||
| import java.util.HashSet; | ||
| import java.util.Set; | ||
| import org.junit.jupiter.api.BeforeAll; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.condition.DisabledOnOs; | ||
| import org.junit.jupiter.api.condition.EnabledOnOs; | ||
| import org.junit.jupiter.api.condition.OS; | ||
|
|
||
| public class DirectoryPathTreeTest { | ||
|
|
||
| private static final String BASE_DIR = "paths/directory-path-tree"; | ||
|
|
||
| private static volatile Path baseDir; | ||
|
|
||
| @BeforeAll | ||
| public static void staticInit() throws Exception { | ||
| final URL url = Thread.currentThread().getContextClassLoader().getResource(BASE_DIR); | ||
| if (url == null) { | ||
| throw new IllegalStateException("Failed to locate " + BASE_DIR + " on the classpath"); | ||
| } | ||
| baseDir = Path.of(url.toURI()).toAbsolutePath(); | ||
| if (!Files.exists(baseDir)) { | ||
| throw new IllegalStateException("Failed to locate " + baseDir); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void acceptExistingPath() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| tree.accept("README.md", visit -> { | ||
| assertThat(visit).isNotNull(); | ||
| assertThat(visit.getRelativePath("/")).isEqualTo("README.md"); | ||
| assertThat(visit.getPath()).exists(); | ||
| assertThat(visit.getRoot()).isEqualTo(root); | ||
| try { | ||
| assertThat(Files.readString(visit.getPath())).isEqualTo("test readme"); | ||
| } catch (IOException e) { | ||
| throw new UncheckedIOException(e); | ||
| } | ||
| }); | ||
| } | ||
|
|
||
| @Test | ||
| public void acceptNonExistentPath() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| tree.accept("non-existent", visit -> { | ||
| assertThat(visit).isNull(); | ||
| }); | ||
| } | ||
|
|
||
| @Test | ||
| public void acceptLegalAbsolutePath() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| tree.accept("/README.md", visit -> { | ||
| assertThat(visit).isNotNull(); | ||
| assertThat(visit.getRelativePath("/")).isEqualTo("README.md"); | ||
| assertThat(visit.getPath()).exists(); | ||
| assertThat(visit.getRoot()).isEqualTo(root); | ||
| try { | ||
| assertThat(Files.readString(visit.getPath())).isEqualTo("test readme"); | ||
| } catch (IOException e) { | ||
| throw new UncheckedIOException(e); | ||
| } | ||
| }); | ||
| } | ||
|
|
||
| @Test | ||
| @DisabledOnOs(OS.WINDOWS) | ||
| public void acceptIllegalAbsolutePathOnLinux() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| final Path absolute = root.getParent().resolve("external.txt"); | ||
| assertThat(absolute).exists(); | ||
| tree.accept(absolute.toString(), visit -> { | ||
| assertThat(visit).isNull(); | ||
| }); | ||
| } | ||
|
|
||
| @Test | ||
| @EnabledOnOs(OS.WINDOWS) | ||
| public void acceptIllegalAbsolutePathOnWindows() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| final Path absolute = root.getParent().resolve("external.txt"); | ||
| assertThat(absolute).exists(); | ||
| try { | ||
| tree.accept(absolute.toString(), visit -> { | ||
| fail("Windows absolute paths are not allowed"); | ||
| }); | ||
| } catch (IllegalArgumentException e) { | ||
| // expected | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void acceptExistingRelativeNonNormalizedPath() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| tree.accept("../root/./other/../README.md", visit -> { | ||
| assertThat(visit).isNotNull(); | ||
| assertThat(visit.getRelativePath("/")).isEqualTo("README.md"); | ||
| assertThat(visit.getPath()).exists(); | ||
| assertThat(visit.getRoot()).isEqualTo(root); | ||
| try { | ||
| assertThat(Files.readString(visit.getPath())).isEqualTo("test readme"); | ||
| } catch (IOException e) { | ||
| throw new UncheckedIOException(e); | ||
| } | ||
| }); | ||
| } | ||
|
|
||
| @Test | ||
| public void acceptNonExistentRelativeNonNormalizedPath() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
| tree.accept("../root/./README.md/../non-existent.txt", visit -> { | ||
| assertThat(visit).isNull(); | ||
| }); | ||
| } | ||
|
|
||
| @Test | ||
| public void walk() throws Exception { | ||
| final Path root = resolveTreeRoot("root"); | ||
| final PathTree tree = PathTree.ofDirectoryOrArchive(root); | ||
|
|
||
| final Set<String> visited = new HashSet<>(); | ||
| final PathVisitor visitor = new PathVisitor() { | ||
| @Override | ||
| public void visitPath(PathVisit visit) { | ||
| visited.add(visit.getRelativePath("/")); | ||
| } | ||
| }; | ||
| tree.walk(visitor); | ||
|
|
||
| assertThat(visited).isEqualTo(Set.of( | ||
| "", | ||
| "README.md", | ||
| "src", | ||
| "src/main", | ||
| "src/main/java", | ||
| "src/main/java/Main.java")); | ||
| } | ||
|
|
||
| /** | ||
| * Returns a path relative to src/test/resources/paths/directory-path-tree/ | ||
| * | ||
| * @param relative relative path | ||
| * @return Path instance | ||
| */ | ||
| private Path resolveTreeRoot(String relative) { | ||
| return baseDir.resolve(relative); | ||
| } | ||
| } |
Oops, something went wrong.