| 1 | package serve |
| 2 | |
| 3 | import ( |
| 4 | "os" |
| 5 | "path/filepath" |
| 6 | "runtime" |
| 7 | "testing" |
| 8 | |
| 9 | "reasonix/internal/config" |
| 10 | "reasonix/internal/control" |
| 11 | ) |
| 12 | |
| 13 | func TestResolveSessionPathRejectsSymlinkEscape(t *testing.T) { |
| 14 | if runtime.GOOS == "windows" { |
| 15 | t.Skip("unprivileged Windows CI cannot create the symlink fixture") |
| 16 | } |
| 17 | sessionDir := t.TempDir() |
| 18 | outsideDir := t.TempDir() |
| 19 | outside := filepath.Join(outsideDir, "outside.jsonl") |
| 20 | if err := os.WriteFile(outside, []byte("keep\n"), 0o644); err != nil { |
| 21 | t.Fatal(err) |
| 22 | } |
| 23 | alias := filepath.Join(sessionDir, "alias.jsonl") |
| 24 | if err := os.Symlink(outside, alias); err != nil { |
| 25 | t.Fatal(err) |
| 26 | } |
| 27 | |
| 28 | ctrl := control.New(control.Options{SessionDir: sessionDir}) |
| 29 | server := New(ctrl, NewBroadcaster(), config.ServeConfig{}) |
| 30 | t.Cleanup(server.Close) |
| 31 | if _, err := server.resolveSessionPath(alias); err == nil || err.Error() != "path outside session dir" { |
| 32 | t.Fatalf("resolve symlink escape error = %v, want path outside session dir", err) |
| 33 | } |
| 34 | } |
| 35 |