github.com/mvdan/u-root-coreutils@v0.0.0-20230122170626-c2eef2898555/pkg/upath/safejoin_test.go (about)

     1  // Copyright 2021 the u-root Authors. All rights reserved
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package upath
     6  
     7  import (
     8  	"testing"
     9  )
    10  
    11  func TestSafeFilepathJoin(t *testing.T) {
    12  	for _, tt := range []struct {
    13  		name         string
    14  		path1, path2 string
    15  		wantPath     string
    16  		wantErr      bool
    17  	}{
    18  		{
    19  			name:     "safe relative paths",
    20  			path1:    "a",
    21  			path2:    "b",
    22  			wantPath: "a/b",
    23  		},
    24  		{
    25  			name:     "safe relative paths 2",
    26  			path1:    "./a",
    27  			path2:    "./b",
    28  			wantPath: "a/b",
    29  		},
    30  		{
    31  			name:    "unsafe absolute paths",
    32  			path1:   "/a",
    33  			path2:   "/b",
    34  			wantErr: true,
    35  		},
    36  		{
    37  			name:     "safe absolute path",
    38  			path1:    "/a",
    39  			path2:    "b",
    40  			wantPath: "/a/b",
    41  		},
    42  		{
    43  			name:    "unsafe absolute path",
    44  			path1:   "a",
    45  			path2:   "/b",
    46  			wantErr: true,
    47  		},
    48  		{
    49  			name:    "unsafe dotdot escape",
    50  			path1:   "/a",
    51  			path2:   "../b",
    52  			wantErr: true,
    53  		},
    54  		{
    55  			name:    "unsafe dotdot escape 2",
    56  			path1:   "/a",
    57  			path2:   "c/d/../../../b",
    58  			wantErr: true,
    59  		},
    60  		{
    61  			name:    "unsafe dotdot escape 3",
    62  			path1:   "/a",
    63  			path2:   "c/d/../../../a/b",
    64  			wantErr: true,
    65  		},
    66  		{
    67  			name:     "safe dotdot",
    68  			path1:    "/a",
    69  			path2:    "c/../b",
    70  			wantPath: "/a/b",
    71  		},
    72  		{
    73  			name:     "safe dotdot 2",
    74  			path1:    "/a",
    75  			path2:    "c/d/../b",
    76  			wantPath: "/a/c/b",
    77  		},
    78  		{
    79  			name:     "safe dotdot 3",
    80  			path1:    "../a",
    81  			path2:    "c/d/../b",
    82  			wantPath: "../a/c/b",
    83  		},
    84  		{
    85  			name:     "safe missing path",
    86  			path1:    "",
    87  			path2:    "b",
    88  			wantPath: "b",
    89  		},
    90  		{
    91  			name:     "safe missing path 2",
    92  			path1:    "a",
    93  			path2:    "",
    94  			wantPath: "a",
    95  		},
    96  	} {
    97  		t.Run(tt.name, func(t *testing.T) {
    98  			got, err := SafeFilepathJoin(tt.path1, tt.path2)
    99  			if (err == nil) == tt.wantErr {
   100  				t.Errorf("safePathJoin(%q, %q) = err %v; wantErr=%v", tt.path1, tt.path2, err, tt.wantErr)
   101  			}
   102  			if got != tt.wantPath {
   103  				t.Errorf("safePathJoin(%q, %q) = %q; want %q", tt.path1, tt.path2, got, tt.wantPath)
   104  			}
   105  		})
   106  	}
   107  }