ThothII/tools/tht/internal/safeio/files_unix_test.go

//go:build !windows

package safeio

import (
	"errors"
	"os"
	"path/filepath"
	"testing"

	"golang.org/x/sys/unix"
)

func TestReadCanonicalRegularRejectsNamedPipeWithoutBlocking(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	pipe := filepath.Join(root, "secret-pipe")
	if err := unix.Mkfifo(pipe, 0o600); err != nil {
		t.Fatal(err)
	}

	if _, err := ReadCanonicalRegular(pipe, 1024); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("named pipe error = %v, want ErrUnsafeFile", err)
	}
}

func TestReplaceCanonicalRegularReplacesOnlySafeRegularTargets(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-replace-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	path := filepath.Join(root, "users.yaml")
	if err := os.WriteFile(path, []byte("old"), 0o600); err != nil {
		t.Fatal(err)
	}

	if err := ReplaceCanonicalRegular(path, []byte("new"), 0o600); err != nil {
		t.Fatal(err)
	}
	contents, err := ReadCanonicalRegular(path, 1024)
	if err != nil {
		t.Fatal(err)
	}
	if string(contents) != "new" {
		t.Fatalf("replacement content = %q, want new", contents)
	}
	info, err := os.Stat(path)
	if err != nil {
		t.Fatal(err)
	}
	if info.Mode().Perm() != 0o600 {
		t.Fatalf("replacement mode = %o, want 600", info.Mode().Perm())
	}

	linked := filepath.Join(root, "linked.yaml")
	if err := os.Link(path, linked); err != nil {
		t.Fatal(err)
	}
	if err := ReplaceCanonicalRegular(path, []byte("unsafe"), 0o600); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("hard-linked replacement error = %v, want ErrUnsafeFile", err)
	}
}

func TestReplaceCanonicalRegularRejectsSymlinkedPathComponents(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-replace-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	realDirectory := filepath.Join(root, "real")
	if err := os.Mkdir(realDirectory, 0o700); err != nil {
		t.Fatal(err)
	}
	target := filepath.Join(realDirectory, "users.yaml")
	if err := os.WriteFile(target, []byte("old"), 0o600); err != nil {
		t.Fatal(err)
	}
	linkedDirectory := filepath.Join(root, "linked")
	if err := os.Symlink(realDirectory, linkedDirectory); err != nil {
		t.Fatal(err)
	}
	if err := ReplaceCanonicalRegular(filepath.Join(linkedDirectory, "users.yaml"), []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("parent symlink replacement error = %v, want ErrUnsafeFile", err)
	}

	linkedFile := filepath.Join(root, "linked-file.yaml")
	if err := os.Symlink(target, linkedFile); err != nil {
		t.Fatal(err)
	}
	if err := ReplaceCanonicalRegular(linkedFile, []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
		t.Fatalf("final symlink replacement error = %v, want ErrUnsafeFile", err)
	}
}

func TestPrivateDirectoryCreationUsesThePinnedParentAfterAncestorSwap(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-mkdirat-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })
	for _, target := range []string{"root", "sessions", "oidc"} {
		t.Run(target, func(t *testing.T) {
			caseRoot := filepath.Join(root, target)
			parent := filepath.Join(caseRoot, "parent")
			if err := os.MkdirAll(parent, 0o700); err != nil {
				t.Fatal(err)
			}
			path := filepath.Join(parent, "auth")
			swappedAncestor := parent
			if target != "root" {
				if err := os.Mkdir(path, 0o700); err != nil {
					t.Fatal(err)
				}
				swappedAncestor = path
				path = filepath.Join(path, target)
			}
			outside := filepath.Join(caseRoot, "outside")
			if err := os.Mkdir(outside, 0o700); err != nil {
				t.Fatal(err)
			}
			movedAncestor := swappedAncestor + "-original"

			if err := createPrivateDirectoryAfterParentOpen(path, func() {
				if err := os.Rename(swappedAncestor, movedAncestor); err != nil {
					t.Fatal(err)
				}
				if err := os.Symlink(outside, swappedAncestor); err != nil {
					t.Fatal(err)
				}
			}); err != nil {
				t.Fatal(err)
			}
			if err := ValidatePrivateDirectory(filepath.Join(movedAncestor, filepath.Base(path))); err != nil {
				t.Fatalf("pinned-parent creation failed: %v", err)
			}
			if _, err := os.Lstat(filepath.Join(outside, filepath.Base(path))); !errors.Is(err, os.ErrNotExist) {
				t.Fatalf("outside target was mutated: %v", err)
			}
		})
	}
}

func TestCreateCanonicalNewPrivateFileUsesPinnedParentAfterAncestorSwap(t *testing.T) {
	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-private-file-openat-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(root) })

	parent := filepath.Join(root, "parent")
	if err := os.Mkdir(parent, 0o700); err != nil {
		t.Fatal(err)
	}
	if err := ProtectPrivateDirectory(parent); err != nil {
		t.Fatal(err)
	}
	outside := filepath.Join(root, "outside")
	if err := os.Mkdir(outside, 0o700); err != nil {
		t.Fatal(err)
	}
	path := filepath.Join(parent, "archive.zip")
	movedParent := parent + "-original"
	swapped := false
	restoreHook := SetPrivateDirectoryTestHookForTest(func(stage string) {
		if stage != "after-canonical-private-file-parent-open" || swapped {
			return
		}
		if err := os.Rename(parent, movedParent); err != nil {
			t.Fatal(err)
		}
		if err := os.Symlink(outside, parent); err != nil {
			t.Fatal(err)
		}
		swapped = true
	})
	t.Cleanup(restoreHook)

	file, err := CreateCanonicalNewPrivateFile(path)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := file.Write([]byte("staged")); err != nil {
		_ = file.Close()
		t.Fatal(err)
	}
	if err := file.Close(); err != nil {
		t.Fatal(err)
	}
	if !swapped {
		t.Fatal("private file creator did not retain the parent before creation")
	}
	created := filepath.Join(movedParent, "archive.zip")
	if err := ValidatePrivateRegular(created); err != nil {
		t.Fatalf("pinned-parent private file validation = %v", err)
	}
	if _, err := os.Lstat(filepath.Join(outside, "archive.zip")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("outside target was mutated: %v", err)
	}
}