Files
backup-tool/tests/security/test_restore_manifest_entries.py

50 lines
1.2 KiB
Python

from __future__ import annotations
import copy
import importlib
import pytest
snapshot = importlib.import_module("backup_tool.snapshot")
def file_entry(path: str = "data.txt") -> dict[str, object]:
return {
"path": path,
"type": "file",
"size": 1,
"blob_digest": "a" * 64,
"mode": 0o600,
"mtime_ns": 0,
"link_target": None,
"metadata_support": ["mode", "mtime_ns"],
}
@pytest.mark.parametrize(
"entries",
[
[file_entry("../escape")],
[file_entry("/absolute")],
[file_entry("windows\\escape")],
[file_entry(), file_entry()],
[file_entry("file"), file_entry("file/child")],
[
{
**file_entry("link"),
"type": "symlink",
"size": 0,
"blob_digest": None,
"link_target": "../escape",
}
],
],
)
def test_restore_rejects_semantically_unsafe_signed_manifest_entries(
entries: list[dict[str, object]],
) -> None:
manifest = {"entries": copy.deepcopy(entries)}
with pytest.raises(snapshot.SnapshotIntegrityError):
snapshot._safe_restore_entries(manifest)