()
| 1709 | |
| 1710 | #[test] |
| 1711 | fn validate_rejects_relative_paths() { |
| 1712 | let mut policy = restrictive_default_policy(); |
| 1713 | policy.filesystem = Some(FilesystemPolicy { |
| 1714 | include_workdir: true, |
| 1715 | read_only: vec!["usr/lib".into()], |
| 1716 | read_write: vec!["/tmp".into()], |
| 1717 | }); |
| 1718 | let violations = validate_sandbox_policy(&policy).unwrap_err(); |
| 1719 | assert!( |
| 1720 | violations |
| 1721 | .iter() |
| 1722 | .any(|v| matches!(v, PolicyViolation::RelativePath { .. })) |
| 1723 | ); |
| 1724 | } |
| 1725 | |
| 1726 | #[test] |
| 1727 | fn validate_rejects_overly_broad_read_write_path() { |
nothing calls this directly
no test coverage detected