😏

evals/security-assurance/fixture/test_archive.py

@@ -0,0 +1,30 @@
+import tempfile
+import unittest
+from pathlib import Path
+
+from archive import extract_entries, normalized_asset_path
+
+
+class ArchiveTests(unittest.TestCase):
+    def test_normalized_asset_path_discards_parent_components(self):
+        self.assertEqual(normalized_asset_path("icons/../safe.svg"), Path("assets/icons/safe.svg"))
+
+    def test_safe_nested_extraction(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            extract_entries([("nested/data.txt", b"ok")], temporary)
+            self.assertEqual(Path(temporary, "nested/data.txt").read_bytes(), b"ok")
+
+    def test_extraction_rejects_parent_escape(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            outside = Path(temporary).parent / "escaped-mmo-eval.txt"
+            outside.unlink(missing_ok=True)
+            try:
+                with self.assertRaises(ValueError):
+                    extract_entries([("../escaped-mmo-eval.txt", b"bad")], temporary)
+                self.assertFalse(outside.exists())
+            finally:
+                outside.unlink(missing_ok=True)
+
+
+if __name__ == "__main__":
+    unittest.main()