62 lines
1.9 KiB
PHP
62 lines
1.9 KiB
PHP
|
<?php
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Security tests for RestoreJobFinished event to ensure it uses secure path validation.
|
||
|
|
*/
|
||
|
|
describe('RestoreJobFinished event security', function () {
|
||
|
|
it('validates that safe paths pass validation', function () {
|
||
|
|
$validPaths = [
|
||
|
|
'/tmp/restore-backup.sql',
|
||
|
|
'/tmp/restore-script.sh',
|
||
|
|
'/tmp/database-dump-'.uniqid().'.sql',
|
||
|
|
];
|
||
|
|
|
||
|
|
foreach ($validPaths as $path) {
|
||
|
|
expect(isSafeTmpPath($path))->toBeTrue();
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
it('validates that malicious paths fail validation', function () {
|
||
|
|
$maliciousPaths = [
|
||
|
|
'/tmp/../etc/passwd',
|
||
|
|
'/tmp/foo/../../etc/shadow',
|
||
|
|
'/etc/sensitive-file',
|
||
|
|
'/var/www/config.php',
|
||
|
|
'/tmp/../../../root/.ssh/id_rsa',
|
||
|
|
];
|
||
|
|
|
||
|
|
foreach ($maliciousPaths as $path) {
|
||
|
|
expect(isSafeTmpPath($path))->toBeFalse();
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
it('rejects URL-encoded path traversal attempts', function () {
|
||
|
|
$encodedTraversalPaths = [
|
||
|
|
'/tmp/%2e%2e/etc/passwd',
|
||
|
|
'/tmp/foo%2f%2e%2e%2f%2e%2e/etc/shadow',
|
||
|
|
urlencode('/tmp/../etc/passwd'),
|
||
|
|
];
|
||
|
|
|
||
|
|
foreach ($encodedTraversalPaths as $path) {
|
||
|
|
expect(isSafeTmpPath($path))->toBeFalse();
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
it('handles edge cases correctly', function () {
|
||
|
|
// Too short
|
||
|
|
expect(isSafeTmpPath('/tmp'))->toBeFalse();
|
||
|
|
expect(isSafeTmpPath('/tmp/'))->toBeFalse();
|
||
|
|
|
||
|
|
// Null/empty
|
||
|
|
expect(isSafeTmpPath(null))->toBeFalse();
|
||
|
|
expect(isSafeTmpPath(''))->toBeFalse();
|
||
|
|
|
||
|
|
// Null byte injection
|
||
|
|
expect(isSafeTmpPath("/tmp/file.sql\0../../etc/passwd"))->toBeFalse();
|
||
|
|
|
||
|
|
// Valid edge cases
|
||
|
|
expect(isSafeTmpPath('/tmp/x'))->toBeTrue();
|
||
|
|
expect(isSafeTmpPath('/tmp/very/deeply/nested/path/to/file.sql'))->toBeTrue();
|
||
|
|
});
|
||
|
|
});
|