94 lines
3.2 KiB
TypeScript
94 lines
3.2 KiB
TypeScript
import fs from "node:fs/promises";
|
|
import path from "node:path";
|
|
import { afterEach, describe, expect, it } from "vitest";
|
|
import { createTrackedTempDirs } from "../test-utils/tracked-temp-dirs.js";
|
|
import { SafeOpenError, openFileWithinRoot, readLocalFileSafely } from "./fs-safe.js";
|
|
|
|
const tempDirs = createTrackedTempDirs();
|
|
|
|
afterEach(async () => {
|
|
await tempDirs.cleanup();
|
|
});
|
|
|
|
describe("fs-safe", () => {
|
|
it("reads a local file safely", async () => {
|
|
const dir = await tempDirs.make("openclaw-fs-safe-");
|
|
const file = path.join(dir, "payload.txt");
|
|
await fs.writeFile(file, "hello");
|
|
|
|
const result = await readLocalFileSafely({ filePath: file });
|
|
expect(result.buffer.toString("utf8")).toBe("hello");
|
|
expect(result.stat.size).toBe(5);
|
|
expect(result.realPath).toContain("payload.txt");
|
|
});
|
|
|
|
it("rejects directories", async () => {
|
|
const dir = await tempDirs.make("openclaw-fs-safe-");
|
|
await expect(readLocalFileSafely({ filePath: dir })).rejects.toMatchObject({
|
|
code: "not-file",
|
|
});
|
|
});
|
|
|
|
it("enforces maxBytes", async () => {
|
|
const dir = await tempDirs.make("openclaw-fs-safe-");
|
|
const file = path.join(dir, "big.bin");
|
|
await fs.writeFile(file, Buffer.alloc(8));
|
|
|
|
await expect(readLocalFileSafely({ filePath: file, maxBytes: 4 })).rejects.toMatchObject({
|
|
code: "too-large",
|
|
});
|
|
});
|
|
|
|
it.runIf(process.platform !== "win32")("rejects symlinks", async () => {
|
|
const dir = await tempDirs.make("openclaw-fs-safe-");
|
|
const target = path.join(dir, "target.txt");
|
|
const link = path.join(dir, "link.txt");
|
|
await fs.writeFile(target, "target");
|
|
await fs.symlink(target, link);
|
|
|
|
await expect(readLocalFileSafely({ filePath: link })).rejects.toMatchObject({
|
|
code: "symlink",
|
|
});
|
|
});
|
|
|
|
it("blocks traversal outside root", async () => {
|
|
const root = await tempDirs.make("openclaw-fs-safe-root-");
|
|
const outside = await tempDirs.make("openclaw-fs-safe-outside-");
|
|
const file = path.join(outside, "outside.txt");
|
|
await fs.writeFile(file, "outside");
|
|
|
|
await expect(
|
|
openFileWithinRoot({
|
|
rootDir: root,
|
|
relativePath: path.join("..", path.basename(outside), "outside.txt"),
|
|
}),
|
|
).rejects.toMatchObject({ code: "invalid-path" });
|
|
});
|
|
|
|
it.runIf(process.platform !== "win32")("blocks symlink escapes under root", async () => {
|
|
const root = await tempDirs.make("openclaw-fs-safe-root-");
|
|
const outside = await tempDirs.make("openclaw-fs-safe-outside-");
|
|
const target = path.join(outside, "outside.txt");
|
|
const link = path.join(root, "link.txt");
|
|
await fs.writeFile(target, "outside");
|
|
await fs.symlink(target, link);
|
|
|
|
await expect(
|
|
openFileWithinRoot({
|
|
rootDir: root,
|
|
relativePath: "link.txt",
|
|
}),
|
|
).rejects.toMatchObject({ code: "invalid-path" });
|
|
});
|
|
|
|
it("returns not-found for missing files", async () => {
|
|
const dir = await tempDirs.make("openclaw-fs-safe-");
|
|
const missing = path.join(dir, "missing.txt");
|
|
|
|
await expect(readLocalFileSafely({ filePath: missing })).rejects.toBeInstanceOf(SafeOpenError);
|
|
await expect(readLocalFileSafely({ filePath: missing })).rejects.toMatchObject({
|
|
code: "not-found",
|
|
});
|
|
});
|
|
});
|