Jens
faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
91 lines
3.3 KiB
Python
91 lines
3.3 KiB
Python
"""Analysis may only read artifacts the runtime itself produced.
|
|
|
|
``tile_manifest_path`` arrives in the detection and segmentation request and was
|
|
read straight off disk, and a manifest entry may name an absolute tile path. A
|
|
manifest outside the storage root is by definition not a governed artifact, so
|
|
consuming one contradicts the rule the whole persistence model rests on — and
|
|
it turns an API field into an unbounded reference to the host filesystem.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from app.core.errors import AppError
|
|
from app.services.storage_service import StorageService
|
|
|
|
|
|
def test_a_path_inside_the_root_is_returned_resolved(tmp_path: Path, monkeypatch) -> None:
|
|
monkeypatch.setenv("STORAGE_ROOT", str(tmp_path))
|
|
target = tmp_path / "tiles" / "manifest.json"
|
|
target.parent.mkdir(parents=True)
|
|
target.write_text("{}", encoding="utf-8")
|
|
|
|
resolved = StorageService.assert_within_storage_root(str(target), label="tile manifest")
|
|
|
|
assert resolved == target.resolve()
|
|
|
|
|
|
def test_a_path_outside_the_root_is_refused(tmp_path: Path, monkeypatch) -> None:
|
|
monkeypatch.setenv("STORAGE_ROOT", str(tmp_path / "storage"))
|
|
(tmp_path / "storage").mkdir()
|
|
outside = tmp_path / "elsewhere.json"
|
|
outside.write_text("{}", encoding="utf-8")
|
|
|
|
with pytest.raises(AppError) as exc_info:
|
|
StorageService.assert_within_storage_root(str(outside), label="tile manifest")
|
|
|
|
assert exc_info.value.code == "STORAGE_PATH_OUTSIDE_ROOT"
|
|
assert "tile manifest" in exc_info.value.message
|
|
|
|
|
|
def test_a_traversal_sequence_cannot_climb_out(tmp_path: Path, monkeypatch) -> None:
|
|
root = tmp_path / "storage"
|
|
root.mkdir()
|
|
monkeypatch.setenv("STORAGE_ROOT", str(root))
|
|
secret = tmp_path / "secret.json"
|
|
secret.write_text("{}", encoding="utf-8")
|
|
|
|
with pytest.raises(AppError) as exc_info:
|
|
StorageService.assert_within_storage_root(str(root / ".." / "secret.json"), label="tile")
|
|
|
|
assert exc_info.value.code == "STORAGE_PATH_OUTSIDE_ROOT"
|
|
|
|
|
|
def test_a_sibling_directory_sharing_a_name_prefix_is_refused(tmp_path: Path, monkeypatch) -> None:
|
|
"""``/data/storage-old`` is not inside ``/data/storage``."""
|
|
|
|
root = tmp_path / "storage"
|
|
root.mkdir()
|
|
sibling = tmp_path / "storage-old"
|
|
sibling.mkdir()
|
|
monkeypatch.setenv("STORAGE_ROOT", str(root))
|
|
target = sibling / "manifest.json"
|
|
target.write_text("{}", encoding="utf-8")
|
|
|
|
with pytest.raises(AppError):
|
|
StorageService.assert_within_storage_root(str(target), label="tile manifest")
|
|
|
|
|
|
def test_an_empty_path_is_refused(tmp_path: Path, monkeypatch) -> None:
|
|
monkeypatch.setenv("STORAGE_ROOT", str(tmp_path))
|
|
|
|
with pytest.raises(AppError):
|
|
StorageService.assert_within_storage_root("", label="tile manifest")
|
|
|
|
|
|
def test_the_check_can_be_disabled_for_an_operator_provisioning_workflow(
|
|
tmp_path: Path, monkeypatch
|
|
) -> None:
|
|
"""Provisioning scripts stage tiles outside the root before ingest."""
|
|
|
|
monkeypatch.setenv("STORAGE_ROOT", str(tmp_path / "storage"))
|
|
monkeypatch.setenv("GEOINTEL_ALLOW_EXTERNAL_ARTIFACT_PATHS", "true")
|
|
(tmp_path / "storage").mkdir()
|
|
outside = tmp_path / "elsewhere.json"
|
|
outside.write_text("{}", encoding="utf-8")
|
|
|
|
assert StorageService.assert_within_storage_root(str(outside), label="tile") == outside.resolve()
|