Showing the changes to apps/server/src/orchestration/workflowScriptQuery.test.ts (1 of 20 files). Show all
Unified · Split
| @@ -5,6 +5,7 @@ import * as NodePath from "node:path"; · 4 unmodified lines | ||
| 5 | 5 | import { it as effectIt } from "@effect/vitest"; |
| 6 | 6 | import * as Effect from "effect/Effect"; |
| 7 | 7 | import { afterAll, assert, describe } from "vite-plus/test"; |
| 8 | +import { symlinksSupported } from "@t3tools/shared/testing/symlinks"; | |
| 8 | 9 | import { readWorkflowScript } from "./workflowScriptQuery.ts"; |
| 9 | 10 | |
| 10 | 11 | const root = NodePath.join(NodeOS.homedir(), ".claude", "projects", "__wf_script_test__"); |
| @@ -14,19 +15,15 @@ NodeFS.writeFileSync(scriptPath, "export const meta = {};\n"); · 3 unmodified lines | ||
| 14 | 15 | const outside = NodePath.join(NodeOS.tmpdir(), "wf-outside.js"); |
| 15 | 16 | NodeFS.writeFileSync(outside, "evil\n"); |
| 16 | 17 | const link = NodePath.join(root, "sneaky.js"); |
| 17 | −try { | |
| 18 | +// Planted only where the host allows it; the escape test is skipped | |
| 19 | +// otherwise rather than passing vacuously on "not-found". | |
| 20 | +if (symlinksSupported) { | |
| 21 | + NodeFS.rmSync(link, { force: true }); | |
| 18 | 22 | NodeFS.symlinkSync(outside, link); |
| 19 | −} catch (error) { | |
| 20 | − // Tolerate only "already exists" from a prior run — any other failure | |
| 21 | − // (EPERM etc.) must fail setup, or the escape test below would pass | |
| 22 | − // vacuously on "not-found" without testing containment. | |
| 23 | − if ((error as NodeJS.ErrnoException).code !== "EEXIST") { | |
| 24 | − throw error; | |
| 23 | + if (!NodeFS.lstatSync(link).isSymbolicLink()) { | |
| 24 | + throw new Error("test setup: sneaky.js must be a symlink"); | |
| 25 | 25 | } |
| 26 | 26 | } |
| 27 | −if (!NodeFS.lstatSync(link).isSymbolicLink()) { | |
| 28 | − throw new Error("test setup: sneaky.js must be a symlink"); | |
| 29 | −} | |
| 30 | 27 | |
| 31 | 28 | afterAll(() => { |
| 32 | 29 | NodeFS.rmSync(root, { recursive: true, force: true }); |
| @@ -53,23 +50,25 @@ describe("readWorkflowScript containment", () => { · 20 unmodified lines | ||
| 53 | 50 | }), |
| 54 | 51 | ); |
| 55 | 52 | |
| 56 | − effectIt.effect("rejects paths outside the root and symlink escapes", () => | |
| 57 | − Effect.gen(function* () { | |
| 58 | − const escaped = yield* Effect.exit(readWorkflowScript({ scriptPath: outside })); | |
| 59 | − assert.equal(escaped._tag, "Failure"); | |
| 60 | − // A symlink INSIDE the root pointing outside must fail specifically on | |
| 61 | − // realpath re-containment — a "not-found" would mean the link was | |
| 62 | − // never exercised and the assertion proves nothing. | |
| 63 | − const sneaky = yield* Effect.exit( | |
| 64 | − readWorkflowScript({ scriptPath: link }).pipe( | |
| 65 | − Effect.flip, | |
| 66 | − Effect.map((error) => error.reason), | |
| 67 | − ), | |
| 68 | − ); | |
| 69 | − assert.equal(sneaky._tag, "Success"); | |
| 70 | − if (sneaky._tag === "Success") { | |
| 71 | − assert.equal(sneaky.value, "outside-root"); | |
| 72 | − } | |
| 73 | − }), | |
| 53 | + effectIt.effect.skipIf(!symlinksSupported)( | |
| 54 | + "rejects paths outside the root and symlink escapes", | |
| 55 | + () => | |
| 56 | + Effect.gen(function* () { | |
| 57 | + const escaped = yield* Effect.exit(readWorkflowScript({ scriptPath: outside })); | |
| 58 | + assert.equal(escaped._tag, "Failure"); | |
| 59 | + // A symlink INSIDE the root pointing outside must fail specifically on | |
| 60 | + // realpath re-containment — a "not-found" would mean the link was | |
| 61 | + // never exercised and the assertion proves nothing. | |
| 62 | + const sneaky = yield* Effect.exit( | |
| 63 | + readWorkflowScript({ scriptPath: link }).pipe( | |
| 64 | + Effect.flip, | |
| 65 | + Effect.map((error) => error.reason), | |
| 66 | + ), | |
| 67 | + ); | |
| 68 | + assert.equal(sneaky._tag, "Success"); | |
| 69 | + if (sneaky._tag === "Success") { | |
| 70 | + assert.equal(sneaky.value, "outside-root"); | |
| 71 | + } | |
| 72 | + }), | |
| 74 | 73 | ); |
| 75 | 74 | }); |