Files
cd/util/security/path_traversal_test.go
zeekay 029896d9b4 util: fix stale Argo-branded test expectations and reword prose
util/tls and util/http assert on strings the production code already
renamed to "Hanzo CD" - the tests still expected the old wording and
were failing on that mismatch alone. util/lua's fixture likewise still
expected "By Argo CD at:" after resource_customizations moved the real
lua actions to "By Hanzo CD at:". The rest (util/kube, util/security,
util/sourceintegrity, util/localconfig, util/github_app) is placeholder
text and local identifiers with nothing outside the process depending
on the exact wording.
2026-09-05 01:12:03 -07:00

29 lines
904 B
Go

package security
import (
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestEnforceToCurrentRoot(t *testing.T) {
t.Parallel()
cleanDir, err := EnforceToCurrentRoot("/home/cd/helmapp/", "/home/cd/helmapp/values.yaml")
require.NoError(t, err)
assert.Equal(t, "/home/cd/helmapp/values.yaml", cleanDir)
// File is outside current working directory
_, err = EnforceToCurrentRoot("/home/cd/helmapp/", "/home/values.yaml")
require.Error(t, err)
// File is outside current working directory
_, err = EnforceToCurrentRoot("/home/cd/helmapp/", "/home/cd/helmapp/../differentapp/values.yaml")
require.Error(t, err)
// Goes back and forth, but still legal
cleanDir, err = EnforceToCurrentRoot("/home/cd/helmapp/", "/home/cd/helmapp/../../cd/helmapp/values.yaml")
require.NoError(t, err)
assert.Equal(t, "/home/cd/helmapp/values.yaml", cleanDir)
}