homeio

1import { describe, expect, it, vi, beforeEach } from "vitest";
2
3const { execFileMock, lstatMock } = vi.hoisted(() => ({
4  execFileMock: vi.fn(),
5  lstatMock: vi.fn(),
6}));
7
8vi.mock("node:child_process", () => ({
9  execFile: execFileMock,
10  spawn: vi.fn(() => ({
11    on: vi.fn((event: string, cb: (code: number) => void) => {
12      if (event === "close") cb(0);
13    }),
14  })),
15}));
16
17vi.mock("node:fs/promises", async (importOriginal) => {
18  const actual = await importOriginal<typeof import("node:fs/promises")>();
19  return {
20    ...actual,
21    lstat: lstatMock,
22  };
23});
24
25vi.mock("@/lib/server/modules/files/path-resolver", () => ({
26  FilesPathError: class FilesPathError extends Error {},
27  resolvePathWithinFilesRoot: vi.fn(async ({ inputPath }: { inputPath: string }) => ({
28    rootPath: "/data",
29    relativePath: inputPath,
30    absolutePath: `/data/${inputPath}`,
31    segments: inputPath.split("/"),
32  })),
33  resolveFilePath: vi.fn(async (p: string) => ({
34    rootPath: "/data",
35    relativePath: p,
36    absolutePath: `/data/${p}`,
37    segments: p.split("/"),
38  })),
39}));
40
41import { unzipEntry } from "@/lib/server/modules/files/service";
42
43function resolveExecFile(stdout: string) {
44  return (_cmd: string, _args: string[], cb: (err: Error | null, res?: { stdout: string; stderr: string }) => void) => {
45    cb(null, { stdout, stderr: "" });
46  };
47}
48
49describe("unzipEntry security validation", () => {
50  beforeEach(() => {
51    vi.restoreAllMocks();
52    execFileMock.mockReset();
53    lstatMock.mockReset();
54    lstatMock.mockResolvedValue({
55      isSymbolicLink: () => false,
56      isFile: () => true,
57    });
58  });
59
60  it("rejects zip archives containing path traversal segments (..)", async () => {
61    execFileMock.mockImplementation((_cmd, args, cb) => {
62      if (args.includes("-1")) {
63        cb(null, { stdout: "sub/file.txt\n../../etc/shadow\n", stderr: "" });
64      }
65    });
66
67    await expect(unzipEntry({ path: "test.zip" })).rejects.toMatchObject({
68      message: "Zip archive contains path traversal entries",
69    });
70  });
71
72  it("rejects zip archives containing absolute paths", async () => {
73    execFileMock.mockImplementation((_cmd, args, cb) => {
74      if (args.includes("-1")) {
75        cb(null, { stdout: "/etc/passwd\n", stderr: "" });
76      }
77    });
78
79    await expect(unzipEntry({ path: "test.zip" })).rejects.toMatchObject({
80      message: "Zip archive contains invalid paths",
81    });
82  });
83
84  it("rejects zip archives containing symbolic links", async () => {
85    execFileMock.mockImplementation((_cmd, args, cb) => {
86      if (args.includes("-1")) {
87        cb(null, { stdout: "malicious_link\n", stderr: "" });
88      } else {
89        // unzip -Z output with symlink flag 'lrwxrwxrwx'
90        cb(null, { stdout: "lrwxrwxrwx 1 user group 11 Jan 1 00:00 malicious_link -> /etc/passwd\n", stderr: "" });
91      }
92    });
93
94    await expect(unzipEntry({ path: "test.zip" })).rejects.toMatchObject({
95      message: "Zip archive contains symbolic links",
96    });
97  });
98});
99