feat(discovery): STACKS_ROOT path safety check

2026-05-22 11:45:56 +02:00
parent 13ccb79ef5
commit 897093ed1c
2 changed files with 55 additions and 0 deletions
@@ -0,0 +1,32 @@
+package discovery_test
+
+import (
+	"testing"
+
+	"github.com/shcizo/package-updater/internal/discovery"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsInsideRoot(t *testing.T) {
+	cases := []struct {
+		name string
+		root string
+		path string
+		want bool
+	}{
+		{"direct child", "/home/shcizo/self-hosted", "/home/shcizo/self-hosted/myapp", true},
+		{"nested", "/home/shcizo/self-hosted", "/home/shcizo/self-hosted/a/b/c", true},
+		{"root itself", "/home/shcizo/self-hosted", "/home/shcizo/self-hosted", true},
+		{"sibling", "/home/shcizo/self-hosted", "/home/shcizo/other", false},
+		{"parent", "/home/shcizo/self-hosted", "/home/shcizo", false},
+		{"unrelated", "/home/shcizo/self-hosted", "/etc/passwd", false},
+		{"prefix-trick", "/home/shcizo/self-hosted", "/home/shcizo/self-hosted-evil", false},
+		{"dotdot escape", "/home/shcizo/self-hosted", "/home/shcizo/self-hosted/../etc", false},
+		{"trailing slash root", "/home/shcizo/self-hosted/", "/home/shcizo/self-hosted/x", true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			require.Equal(t, c.want, discovery.IsInsideRoot(c.root, c.path))
+		})
+	}
+}