31 lines
1.1 KiB
Python
31 lines
1.1 KiB
Python
|
import tempfile
|
||
|
|
import unittest
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from archive import extract_entries, normalized_asset_path
|
||
|
|
|
||
|
|
|
||
|
|
class ArchiveTests(unittest.TestCase):
|
||
|
|
def test_normalized_asset_path_discards_parent_components(self):
|
||
|
|
self.assertEqual(normalized_asset_path("icons/../safe.svg"), Path("assets/icons/safe.svg"))
|
||
|
|
|
||
|
|
def test_safe_nested_extraction(self):
|
||
|
|
with tempfile.TemporaryDirectory() as temporary:
|
||
|
|
extract_entries([("nested/data.txt", b"ok")], temporary)
|
||
|
|
self.assertEqual(Path(temporary, "nested/data.txt").read_bytes(), b"ok")
|
||
|
|
|
||
|
|
def test_extraction_rejects_parent_escape(self):
|
||
|
|
with tempfile.TemporaryDirectory() as temporary:
|
||
|
|
outside = Path(temporary).parent / "escaped-mmo-eval.txt"
|
||
|
|
outside.unlink(missing_ok=True)
|
||
|
|
try:
|
||
|
|
with self.assertRaises(ValueError):
|
||
|
|
extract_entries([("../escaped-mmo-eval.txt", b"bad")], temporary)
|
||
|
|
self.assertFalse(outside.exists())
|
||
|
|
finally:
|
||
|
|
outside.unlink(missing_ok=True)
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|