132 lines
3.6 KiB
Go
132 lines
3.6 KiB
Go
package client
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"crypto-miner-agent/deploy"
|
|
)
|
|
|
|
type commandResult struct {
|
|
action string
|
|
success bool
|
|
message string
|
|
}
|
|
|
|
func captureCommandResult(t *testing.T, c *AgentClient) (done <-chan struct{}, result *commandResult) {
|
|
t.Helper()
|
|
ch := make(chan struct{})
|
|
var mu sync.Mutex
|
|
out := &commandResult{}
|
|
c.commandResultHook = func(action string, success bool, message string) {
|
|
mu.Lock()
|
|
out.action = action
|
|
out.success = success
|
|
out.message = message
|
|
mu.Unlock()
|
|
close(ch)
|
|
}
|
|
t.Cleanup(func() { c.commandResultHook = nil })
|
|
return ch, out
|
|
}
|
|
|
|
func TestUploadCommandRejectsPathTraversal(t *testing.T) {
|
|
data := base64.StdEncoding.EncodeToString([]byte("payload"))
|
|
|
|
cases := []struct {
|
|
name string
|
|
path string
|
|
}{
|
|
{name: "unix_relative", path: "../../etc/passwd"},
|
|
{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
|
|
{name: "embedded_traversal", path: "uploads/../../outside.txt"},
|
|
{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
_, err := deploy.ResolveRemotePath(tc.path)
|
|
if err == nil {
|
|
t.Fatalf("ResolveRemotePath(%q) should reject traversal", tc.path)
|
|
}
|
|
if !strings.Contains(err.Error(), "path traversal") {
|
|
t.Fatalf("ResolveRemotePath(%q) error = %q, want path traversal rejection", tc.path, err.Error())
|
|
}
|
|
|
|
c := newTestClient(t)
|
|
done, got := captureCommandResult(t, c)
|
|
c.handleCommand("upload", 0, "", tc.path, data, "")
|
|
<-done
|
|
|
|
if got.action != "upload" {
|
|
t.Fatalf("action = %q, want upload", got.action)
|
|
}
|
|
if got.success {
|
|
t.Fatalf("upload with %q should fail (success=true, message=%q)", tc.path, got.message)
|
|
}
|
|
if !strings.Contains(got.message, "path traversal") {
|
|
t.Fatalf("message = %q, want path traversal error from ResolveRemotePath", got.message)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
|
|
func TestDownloadCommandRejectsPathTraversal(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
path string
|
|
}{
|
|
{name: "unix_relative", path: "../../etc/passwd"},
|
|
{name: "windows_relative", path: `..\..\Windows\System32\config\sam`},
|
|
{name: "embedded_traversal", path: "uploads/../../outside.txt"},
|
|
{name: "absolute_with_traversal", path: "/var/log/../../etc/shadow"},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
_, err := deploy.ResolveRemotePath(tc.path)
|
|
if err == nil {
|
|
t.Fatalf("ResolveRemotePath(%q) should reject traversal", tc.path)
|
|
}
|
|
if !strings.Contains(err.Error(), "path traversal") {
|
|
t.Fatalf("ResolveRemotePath(%q) error = %q, want path traversal rejection", tc.path, err.Error())
|
|
}
|
|
|
|
c := newTestClient(t)
|
|
done, got := captureCommandResult(t, c)
|
|
c.handleCommand("download", 0, "", tc.path, "", "")
|
|
<-done
|
|
|
|
if got.action != "download" {
|
|
t.Fatalf("action = %q, want download", got.action)
|
|
}
|
|
if got.success {
|
|
t.Fatalf("download with %q should fail (success=true, message=%q)", tc.path, got.message)
|
|
}
|
|
if !strings.Contains(got.message, "path traversal") {
|
|
t.Fatalf("message = %q, want path traversal error from ResolveRemotePath", got.message)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
func TestUploadCommandAcceptsSafePath(t *testing.T) {
|
|
dir := t.TempDir()
|
|
dest := dir + "/notes.txt"
|
|
data := base64.StdEncoding.EncodeToString([]byte("ok"))
|
|
|
|
c := newTestClient(t)
|
|
done, got := captureCommandResult(t, c)
|
|
c.handleCommand("upload", 0, "", dest, data, "")
|
|
<-done
|
|
|
|
if !got.success {
|
|
t.Fatalf("safe upload failed: %s", got.message)
|
|
}
|
|
if got.action != "upload" {
|
|
t.Fatalf("action = %q, want upload", got.action)
|
|
}
|
|
}
|