()
| 1693 | |
| 1694 | #[test] |
| 1695 | fn validate_rejects_path_traversal() { |
| 1696 | let mut policy = restrictive_default_policy(); |
| 1697 | policy.filesystem = Some(FilesystemPolicy { |
| 1698 | include_workdir: true, |
| 1699 | read_only: vec!["/usr/../etc/shadow".into()], |
| 1700 | read_write: vec!["/tmp".into()], |
| 1701 | }); |
| 1702 | let violations = validate_sandbox_policy(&policy).unwrap_err(); |
| 1703 | assert!( |
| 1704 | violations |
| 1705 | .iter() |
| 1706 | .any(|v| matches!(v, PolicyViolation::PathTraversal { .. })) |
| 1707 | ); |
| 1708 | } |
| 1709 | |
| 1710 | #[test] |
| 1711 | fn validate_rejects_relative_paths() { |
nothing calls this directly
no test coverage detected