Function TestValidatePathWithinBase

pkg/fileutil/fileutil_test.go:442–513

(t *testing.T)

}

func TestValidatePathWithinBase(t *testing.T) {
	base := t.TempDir()

	tests := []struct {
		name      string
		candidate string
		shouldErr bool
	}{
		{
			name:      "file directly inside base",
			candidate: filepath.Join(base, "file.txt"),
			shouldErr: false,
		},
		{
			name:      "file in subdirectory",
			candidate: filepath.Join(base, "sub", "file.txt"),
			shouldErr: false,
		},
		{
			name:      "base directory itself",
			candidate: base,
			shouldErr: false,
		},
		{
			name:      "path traversal with ..",
			candidate: filepath.Join(base, "..", "escape.txt"),
			shouldErr: true,
		},
		{
			name:      "deeply nested traversal",
			candidate: filepath.Join(base, "a", "b", "..", "..", "..", "escape.txt"),
			shouldErr: true,
		},
		{
			name:      "absolute path outside base",
			candidate: "/etc/passwd",
			shouldErr: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := ValidatePathWithinBase(base, tt.candidate)
			if tt.shouldErr {
				require.Error(t, err, "ValidatePathWithinBase should reject path %q relative to %q", tt.candidate, base)
				assert.Contains(t, err.Error(), "escapes base directory", "Error should describe the escape")
			} else {
				require.NoError(t, err, "ValidatePathWithinBase should accept path %q within %q", tt.candidate, base)
			}
		})
	}

	t.Run("symlink escape", func(t *testing.T) {
		// Create a real file outside the base directory.
		outsideFile, err := os.CreateTemp("", "validatepathwithinbase-outside-*")
		require.NoError(t, err, "failed to create outside file")
		t.Cleanup(func() { _ = os.Remove(outsideFile.Name()) })
		outsidePath := outsideFile.Name()