jochen
6d32975ca6
A path written as ${dir:<id>} can resolve under the agent's home, and a
literal /home path may be it; both escaped the check (hq ADR 0266).
50 lines
1.7 KiB
Go
50 lines
1.7 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func manifest(t *testing.T, root, module, resources string) {
|
|
t.Helper()
|
|
dir := filepath.Join(root, "modules", module)
|
|
if err := os.MkdirAll(dir, 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
body := `{"module":"` + module + `","resources":[` + resources + `]}`
|
|
if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestAnArchiveOrAFileWrittenIntoUnderTheAgentsHomeIsRefused(t *testing.T) {
|
|
root := t.TempDir()
|
|
manifest(t, root, "a", `{"id":"theme","type":"archive","path":"${machine:agent-home}/.local/share/x"}`)
|
|
manifest(t, root, "b", `{"id":"cfg","type":"file","path":"${machine:agent-home}/.claude.json","into":"json","content":"{}"}`)
|
|
manifest(t, root, "c", `{"id":"dir","type":"directory","path":"${machine:agent-home}/.claude"},`+
|
|
`{"id":"whole","type":"file","path":"${machine:agent-home}/x","content":"y"},`+
|
|
`{"id":"op","type":"archive","path":"${machine:account-home}/.local/share/x"}`)
|
|
manifest(t, root, "d", `{"id":"home","type":"directory","path":"${machine:agent-home}/.claude"},`+
|
|
`{"id":"inner","type":"directory","path":"${dir:home}/inner"},`+
|
|
`{"id":"via-dir","type":"archive","path":"${dir:inner}/theme"}`)
|
|
manifest(t, root, "e", `{"id":"literal","type":"file","path":"/home/agent/.bashrc","into":"block","content":"x"}`)
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(found) != 4 || found[0].Module != "a" || found[1].Module != "b" || found[2].ID != "via-dir" || found[3].ID != "literal" {
|
|
t.Fatalf("refused %+v", found)
|
|
}
|
|
}
|
|
|
|
func TestTheCatalogueHasNone(t *testing.T) {
|
|
found, err := Check("../..")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(found) != 0 {
|
|
t.Fatalf("%+v", found)
|
|
}
|
|
}
|