44 lines
2.1 KiB
Python
44 lines
2.1 KiB
Python
|
"""Read-only DAV metadata parser tests; no provider or credential access."""
|
||
|
|
import importlib.util
|
||
|
|
from pathlib import Path
|
||
|
|
import pytest
|
||
|
|
|
||
|
|
ROOT=Path(__file__).resolve().parents[1]
|
||
|
|
spec=importlib.util.spec_from_file_location('storage_inventory',ROOT/'tools/bootstrap-recovery/inventory-storage-share.py')
|
||
|
|
module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
|
||
|
|
|
||
|
|
|
||
|
|
def body(path, kind='file', size='16', origin=''):
|
||
|
|
collection='<d:collection/>' if kind=='dir' else ''
|
||
|
|
return f'''<d:multistatus xmlns:d="DAV:"><d:response><d:href>{origin}{path}</d:href>
|
||
|
|
<d:propstat><d:status>HTTP/1.1 200 OK</d:status><d:prop><d:resourcetype>{collection}</d:resourcetype>
|
||
|
|
<d:getcontentlength>{size}</d:getcontentlength></d:prop></d:propstat></d:response></d:multistatus>'''.encode()
|
||
|
|
|
||
|
|
|
||
|
|
def test_only_closed_safe_metadata_is_returned():
|
||
|
|
raw=body(module.BASE+'bootstrap.tar.age')
|
||
|
|
assert module.parse_listing(raw,'')==[{'name':'bootstrap.tar.age','directory':False,'bytes':16}]
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.parametrize('path,origin',[(module.BASE+'%2e%2e/else.age',''),
|
||
|
|
('/other/account/backup.age',''),(module.BASE+'backup.age','https://unapproved.invalid')])
|
||
|
|
def test_foreign_and_escaping_references_refuse(path,origin):
|
||
|
|
with pytest.raises(module.Refused):module.parse_listing(body(path,origin=origin),'')
|
||
|
|
|
||
|
|
|
||
|
|
def test_non_numeric_size_and_oversized_response_refuse():
|
||
|
|
with pytest.raises(module.Refused):module.parse_listing(body(module.BASE+'backup.age',size='not-a-size'),'')
|
||
|
|
with pytest.raises(module.Refused):module.parse_listing(b'X'*(module.LIMIT+1),'')
|
||
|
|
|
||
|
|
|
||
|
|
def test_unrecognized_plaintext_files_are_not_exported():
|
||
|
|
assert module.parse_listing(body(module.BASE+'private-password.txt'),'')==[]
|
||
|
|
|
||
|
|
|
||
|
|
def test_unrelated_authenticated_role_cannot_read_retrieval_credential(monkeypatch):
|
||
|
|
calls=[]
|
||
|
|
monkeypatch.setattr(module,'bao',lambda args:calls.append(args) or object())
|
||
|
|
monkeypatch.setattr(module,'data',lambda result:{'data':{'policies':['default'],'path':'auth/netkingdom/oidc/callback'}})
|
||
|
|
with pytest.raises(module.Refused):module.inventory()
|
||
|
|
assert calls==[['token','lookup','-format=json']]
|