393 lines
11 KiB
Go
393 lines
11 KiB
Go
package installer
|
|
|
|
import (
|
|
"archive/zip"
|
|
"bytes"
|
|
"errors"
|
|
"math"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestExtractorExtractsPayloadOnly(t *testing.T) {
|
|
archivePath := writeTestZIP(t, []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{"entrypoint":"bin/App.exe"}`)},
|
|
{name: "files.json", body: []byte(`{"files":[]}`)},
|
|
{name: "payload/bin/", mode: os.ModeDir | 0o755},
|
|
{name: "payload/bin/App.exe", body: []byte("executable"), mode: 0o755},
|
|
{name: "payload/readme.txt", body: []byte("hello")},
|
|
})
|
|
destination := filepath.Join(t.TempDir(), "staging")
|
|
extractor := mustExtractor(t, testLimits())
|
|
|
|
result, err := extractor.ExtractFile(archivePath, destination, "bin/App.exe")
|
|
if err != nil {
|
|
t.Fatalf("ExtractFile() error = %v", err)
|
|
}
|
|
if result.Files != 2 {
|
|
t.Fatalf("Files = %d, want 2", result.Files)
|
|
}
|
|
if result.Bytes != int64(len("executable")+len("hello")) {
|
|
t.Fatalf("Bytes = %d, want %d", result.Bytes, len("executable")+len("hello"))
|
|
}
|
|
if _, err := os.Stat(result.EntrypointPath); err != nil {
|
|
t.Fatalf("entrypoint stat error = %v", err)
|
|
}
|
|
if _, err := os.Stat(filepath.Join(destination, "app.json")); !os.IsNotExist(err) {
|
|
t.Fatalf("app.json should not be extracted, stat error = %v", err)
|
|
}
|
|
}
|
|
|
|
func TestExtractorRejectsAttackArchives(t *testing.T) {
|
|
base := []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{}`)},
|
|
{name: "payload/App.exe", body: []byte("ok")},
|
|
}
|
|
tests := []struct {
|
|
name string
|
|
entries []testZIPEntry
|
|
entrypoint string
|
|
limits Limits
|
|
wantErr error
|
|
}{
|
|
{
|
|
name: "absolute path",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "/payload/evil.exe", body: []byte("x")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrPathEscape,
|
|
},
|
|
{
|
|
name: "drive path",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "C:/payload/evil.exe", body: []byte("x")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrPathEscape,
|
|
},
|
|
{
|
|
name: "ADS path",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "payload/App.exe:stream", body: []byte("x")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrPathEscape,
|
|
},
|
|
{
|
|
name: "dot dot traversal",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "payload/../evil.exe", body: []byte("x")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrPathEscape,
|
|
},
|
|
{
|
|
name: "backslash traversal",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: `payload\..\evil.exe`, body: []byte("x")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrPathEscape,
|
|
},
|
|
{
|
|
name: "encrypted entry",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "payload/secret.bin", body: []byte("x"), flags: 0x1}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrEncryptedEntry,
|
|
},
|
|
{
|
|
name: "symlink",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{
|
|
name: "payload/link",
|
|
body: []byte("../../outside"),
|
|
mode: os.ModeSymlink | 0o777,
|
|
}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrUnsupportedEntry,
|
|
},
|
|
{
|
|
name: "special file",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "payload/pipe", mode: os.ModeNamedPipe | 0o600}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrUnsupportedEntry,
|
|
},
|
|
{
|
|
name: "case folded duplicate",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "payload/app.exe", body: []byte("duplicate")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrDuplicateEntry,
|
|
},
|
|
{
|
|
name: "unexpected top level entry",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "install.bat", body: []byte("echo unsafe")}),
|
|
entrypoint: "App.exe",
|
|
limits: testLimits(),
|
|
wantErr: ErrUnexpectedEntry,
|
|
},
|
|
{
|
|
name: "too many entries",
|
|
entries: appendEntries(base,
|
|
testZIPEntry{name: "payload/extra.txt", body: []byte("x")}),
|
|
entrypoint: "App.exe",
|
|
limits: Limits{
|
|
MaxEntries: 2,
|
|
MaxUncompressedBytes: 1024,
|
|
MaxCompressionRatio: 100,
|
|
},
|
|
wantErr: ErrTooManyEntries,
|
|
},
|
|
{
|
|
name: "expanded size",
|
|
entries: []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{}`)},
|
|
{name: "payload/App.exe", body: []byte("0123456789")},
|
|
},
|
|
entrypoint: "App.exe",
|
|
limits: Limits{
|
|
MaxEntries: 10,
|
|
MaxUncompressedBytes: 8,
|
|
MaxCompressionRatio: 100,
|
|
},
|
|
wantErr: ErrExpandedTooLarge,
|
|
},
|
|
{
|
|
name: "compression ratio",
|
|
entries: []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{}`)},
|
|
{
|
|
name: "payload/App.exe",
|
|
body: bytes.Repeat([]byte("A"), 4096),
|
|
method: zip.Deflate,
|
|
},
|
|
},
|
|
entrypoint: "App.exe",
|
|
limits: Limits{
|
|
MaxEntries: 10,
|
|
MaxUncompressedBytes: 8192,
|
|
MaxCompressionRatio: 2,
|
|
},
|
|
wantErr: ErrCompressionRatio,
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
archivePath := writeTestZIP(t, test.entries)
|
|
destination := filepath.Join(t.TempDir(), "staging")
|
|
extractor := mustExtractor(t, test.limits)
|
|
|
|
_, err := extractor.ExtractFile(archivePath, destination, test.entrypoint)
|
|
if !errors.Is(err, test.wantErr) {
|
|
t.Fatalf("ExtractFile() error = %v, want %v", err, test.wantErr)
|
|
}
|
|
if _, statErr := os.Stat(destination); !os.IsNotExist(statErr) {
|
|
t.Fatalf("rejected archive left staging, stat error = %v", statErr)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractorRejectsInvalidEntrypoints(t *testing.T) {
|
|
archivePath := writeTestZIP(t, []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{}`)},
|
|
{name: "payload/App.exe", body: []byte("ok")},
|
|
})
|
|
tests := []struct {
|
|
entrypoint string
|
|
wantErr error
|
|
}{
|
|
{entrypoint: "../App.exe", wantErr: ErrEntrypointInvalid},
|
|
{entrypoint: "/App.exe", wantErr: ErrEntrypointInvalid},
|
|
{entrypoint: `..\App.exe`, wantErr: ErrEntrypointInvalid},
|
|
{entrypoint: "payload/App.exe", wantErr: ErrEntrypointInvalid},
|
|
{entrypoint: "Missing.exe", wantErr: ErrEntrypointMissing},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.entrypoint, func(t *testing.T) {
|
|
destination := filepath.Join(t.TempDir(), "staging")
|
|
extractor := mustExtractor(t, testLimits())
|
|
_, err := extractor.ExtractFile(archivePath, destination, test.entrypoint)
|
|
if !errors.Is(err, test.wantErr) {
|
|
t.Fatalf("ExtractFile() error = %v, want %v", err, test.wantErr)
|
|
}
|
|
if _, statErr := os.Stat(destination); !os.IsNotExist(statErr) {
|
|
t.Fatalf("invalid entrypoint left staging, stat error = %v", statErr)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestExtractorRejectsExistingDestination(t *testing.T) {
|
|
archivePath := writeTestZIP(t, []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{}`)},
|
|
{name: "payload/App.exe", body: []byte("ok")},
|
|
})
|
|
destination := filepath.Join(t.TempDir(), "staging")
|
|
if err := os.Mkdir(destination, 0o700); err != nil {
|
|
t.Fatalf("Mkdir() error = %v", err)
|
|
}
|
|
extractor := mustExtractor(t, testLimits())
|
|
|
|
_, err := extractor.ExtractFile(archivePath, destination, "App.exe")
|
|
if !errors.Is(err, ErrDestinationExists) {
|
|
t.Fatalf("ExtractFile() error = %v, want %v", err, ErrDestinationExists)
|
|
}
|
|
}
|
|
|
|
func TestExtractorRemovesDestinationAfterCopyFailure(t *testing.T) {
|
|
archivePath := writeTestZIP(t, []testZIPEntry{
|
|
{name: "app.json", body: []byte(`{}`)},
|
|
{name: "payload/App.exe", body: []byte("verified bytes"), method: zip.Store},
|
|
})
|
|
corruptZIPEntryData(t, archivePath, "payload/App.exe")
|
|
destination := filepath.Join(t.TempDir(), "staging")
|
|
extractor := mustExtractor(t, testLimits())
|
|
|
|
_, err := extractor.ExtractFile(archivePath, destination, "App.exe")
|
|
if !errors.Is(err, ErrArchiveCorrupt) {
|
|
t.Fatalf("ExtractFile() error = %v, want %v", err, ErrArchiveCorrupt)
|
|
}
|
|
if _, statErr := os.Stat(destination); !os.IsNotExist(statErr) {
|
|
t.Fatalf("copy failure left staging, stat error = %v", statErr)
|
|
}
|
|
}
|
|
|
|
type testZIPEntry struct {
|
|
name string
|
|
body []byte
|
|
mode os.FileMode
|
|
method uint16
|
|
flags uint16
|
|
}
|
|
|
|
func testLimits() Limits {
|
|
return Limits{
|
|
MaxEntries: 20,
|
|
MaxUncompressedBytes: 16 * 1024,
|
|
MaxCompressionRatio: 100,
|
|
}
|
|
}
|
|
|
|
func mustExtractor(t *testing.T, limits Limits) Extractor {
|
|
t.Helper()
|
|
extractor, err := NewExtractor(limits)
|
|
if err != nil {
|
|
t.Fatalf("NewExtractor() error = %v", err)
|
|
}
|
|
return extractor
|
|
}
|
|
|
|
func appendEntries(base []testZIPEntry, extra ...testZIPEntry) []testZIPEntry {
|
|
result := append([]testZIPEntry(nil), base...)
|
|
return append(result, extra...)
|
|
}
|
|
|
|
func writeTestZIP(t *testing.T, entries []testZIPEntry) string {
|
|
t.Helper()
|
|
path := filepath.Join(t.TempDir(), "package.zip")
|
|
file, err := os.Create(path)
|
|
if err != nil {
|
|
t.Fatalf("create ZIP: %v", err)
|
|
}
|
|
writer := zip.NewWriter(file)
|
|
for _, entry := range entries {
|
|
header := &zip.FileHeader{
|
|
Name: entry.name,
|
|
Method: entry.method,
|
|
Flags: entry.flags,
|
|
}
|
|
mode := entry.mode
|
|
if mode == 0 {
|
|
mode = 0o600
|
|
}
|
|
header.SetMode(mode)
|
|
part, err := writer.CreateHeader(header)
|
|
if err != nil {
|
|
writer.Close()
|
|
file.Close()
|
|
t.Fatalf("create ZIP entry %s: %v", entry.name, err)
|
|
}
|
|
if _, err := part.Write(entry.body); err != nil {
|
|
writer.Close()
|
|
file.Close()
|
|
t.Fatalf("write ZIP entry %s: %v", entry.name, err)
|
|
}
|
|
}
|
|
if err := writer.Close(); err != nil {
|
|
file.Close()
|
|
t.Fatalf("close ZIP writer: %v", err)
|
|
}
|
|
if err := file.Close(); err != nil {
|
|
t.Fatalf("close ZIP file: %v", err)
|
|
}
|
|
return path
|
|
}
|
|
|
|
func corruptZIPEntryData(t *testing.T, archivePath, entryName string) {
|
|
t.Helper()
|
|
reader, err := zip.OpenReader(archivePath)
|
|
if err != nil {
|
|
t.Fatalf("open ZIP for corruption: %v", err)
|
|
}
|
|
var offset int64 = -1
|
|
for _, file := range reader.File {
|
|
if file.Name == entryName {
|
|
offset, err = file.DataOffset()
|
|
if err != nil {
|
|
reader.Close()
|
|
t.Fatalf("entry data offset: %v", err)
|
|
}
|
|
break
|
|
}
|
|
}
|
|
if err := reader.Close(); err != nil {
|
|
t.Fatalf("close ZIP reader: %v", err)
|
|
}
|
|
if offset < 0 {
|
|
t.Fatalf("entry %s not found", entryName)
|
|
}
|
|
|
|
data, err := os.ReadFile(archivePath)
|
|
if err != nil {
|
|
t.Fatalf("read ZIP for corruption: %v", err)
|
|
}
|
|
data[offset] ^= 0xff
|
|
if err := os.WriteFile(archivePath, data, 0o600); err != nil {
|
|
t.Fatalf("write corrupted ZIP: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestDefaultLimitsAreValid(t *testing.T) {
|
|
if _, err := NewExtractor(DefaultLimits()); err != nil {
|
|
t.Fatalf("NewExtractor(DefaultLimits()) error = %v", err)
|
|
}
|
|
}
|
|
|
|
func TestExtractorRejectsInvalidLimits(t *testing.T) {
|
|
tests := []Limits{
|
|
{MaxEntries: 0, MaxUncompressedBytes: 1, MaxCompressionRatio: 1},
|
|
{MaxEntries: 1, MaxUncompressedBytes: 0, MaxCompressionRatio: 1},
|
|
{MaxEntries: 1, MaxUncompressedBytes: 1, MaxCompressionRatio: 0},
|
|
{MaxEntries: 1, MaxUncompressedBytes: 1, MaxCompressionRatio: math.NaN()},
|
|
{MaxEntries: 1, MaxUncompressedBytes: 1, MaxCompressionRatio: math.Inf(1)},
|
|
}
|
|
|
|
for index, limits := range tests {
|
|
if _, err := NewExtractor(limits); !errors.Is(err, ErrInvalidLimits) {
|
|
t.Errorf("case %d NewExtractor() error = %v, want %v", index, err, ErrInvalidLimits)
|
|
}
|
|
}
|
|
}
|