|
| 1 | +import { describe, expect, mock, test } from 'bun:test' |
| 2 | +import { logMock } from '../../../../tests/mocks/log' |
| 3 | +import { debugMock } from '../../../../tests/mocks/debug' |
| 4 | + |
| 5 | +// Cut the bootstrap/state dependency chain (mock.module requirement). |
| 6 | +mock.module('src/utils/log.ts', logMock) |
| 7 | +mock.module('src/utils/debug.ts', debugMock) |
| 8 | +mock.module('bun:bundle', () => ({ |
| 9 | + feature: (_name: string) => false, |
| 10 | +})) |
| 11 | + |
| 12 | +// MACRO is a build-time define injected by `bun --define` (see |
| 13 | +// scripts/dev.ts → -d flags). Without it, `declare const MACRO` references |
| 14 | +// in source code resolve to `undefined` at runtime and crash any function |
| 15 | +// that touches `MACRO.VERSION` (e.g. `getBundledSkillsRoot` via |
| 16 | +// `checkReadableInternalPath`). |
| 17 | +// Setting it on globalThis lets the bare `MACRO` identifier resolve at |
| 18 | +// runtime in tests. |
| 19 | +;(globalThis as unknown as { MACRO: { VERSION: string } }).MACRO = { |
| 20 | + VERSION: 'test', |
| 21 | +} |
| 22 | + |
| 23 | +const { validatePath } = await import('../pathValidation.js') |
| 24 | +const { getEmptyToolPermissionContext } = await import('../../../Tool.js') |
| 25 | + |
| 26 | +function makeContext(): ReturnType<typeof getEmptyToolPermissionContext> { |
| 27 | + return getEmptyToolPermissionContext() |
| 28 | +} |
| 29 | + |
| 30 | +const isWindows = process.platform === 'win32' |
| 31 | +const describeIfWindows = isWindows ? describe : describe.skip |
| 32 | + |
| 33 | +// ─── MinGW path normalization (Windows) ────────────────────────────────── |
| 34 | +// |
| 35 | +// These tests pin the fix for a sandbox-escape class: on Windows, the Git |
| 36 | +// Bash shell interprets paths like `/c/Users/foo/bar.txt` as `C:\Users\foo\bar.txt` |
| 37 | +// (the C: drive). However, the Node `path` module treats such paths as |
| 38 | +// drive-relative absolute paths on the current drive, so: |
| 39 | +// - path.isAbsolute('/c/Users/foo/bar.txt') === true (on Windows) |
| 40 | +// - path.resolve('D:\\project', '/c/Users/foo/bar.txt') |
| 41 | +// === 'D:\\c\\Users\\foo\\bar.txt' (on Windows) |
| 42 | +// |
| 43 | +// That means without normalization, validatePath would compare |
| 44 | +// `D:\c\Users\foo\bar.txt` against the allowed-directories list, while |
| 45 | +// Git Bash actually writes to `C:\Users\foo\bar.txt` — a completely |
| 46 | +// different filesystem location. This is a TOCTOU/sandbox-escape bug. |
| 47 | +// |
| 48 | +// The fix runs `posixPathToWindowsPath` on Windows before resolution, |
| 49 | +// converting `/c/...` and `/cygdrive/c/...` to their `C:\...` form so the |
| 50 | +// validator's path space matches the shell's. |
| 51 | +describeIfWindows('validatePath MinGW path normalization', () => { |
| 52 | + test('converts /c/Users/foo/file.txt to C:\\Users\\foo\\file.txt', () => { |
| 53 | + const result = validatePath( |
| 54 | + '/c/Users/foo/file.txt', |
| 55 | + 'D:\\project', |
| 56 | + makeContext(), |
| 57 | + 'read', |
| 58 | + ) |
| 59 | + // resolvedPath is the canonical form the validator (and ultimately the |
| 60 | + // shell) operates on. It must be the Windows-style path, not the |
| 61 | + // drive-relative form `D:\c\Users\foo\file.txt`. |
| 62 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe( |
| 63 | + 'C:\\Users\\foo\\file.txt', |
| 64 | + ) |
| 65 | + }) |
| 66 | + |
| 67 | + test('converts /cygdrive/c/Users/foo/file.txt to C:\\Users\\foo\\file.txt', () => { |
| 68 | + const result = validatePath( |
| 69 | + '/cygdrive/c/Users/foo/file.txt', |
| 70 | + 'D:\\project', |
| 71 | + makeContext(), |
| 72 | + 'read', |
| 73 | + ) |
| 74 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe( |
| 75 | + 'C:\\Users\\foo\\file.txt', |
| 76 | + ) |
| 77 | + }) |
| 78 | + |
| 79 | + test('uppercases the drive letter', () => { |
| 80 | + const result = validatePath( |
| 81 | + '/d/work/file.txt', |
| 82 | + 'C:\\project', |
| 83 | + makeContext(), |
| 84 | + 'read', |
| 85 | + ) |
| 86 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe('D:\\work\\file.txt') |
| 87 | + }) |
| 88 | + |
| 89 | + test('preserves Windows paths unchanged', () => { |
| 90 | + // An already-Windows path should not be touched. |
| 91 | + const result = validatePath( |
| 92 | + 'C:\\Users\\foo\\file.txt', |
| 93 | + 'D:\\project', |
| 94 | + makeContext(), |
| 95 | + 'read', |
| 96 | + ) |
| 97 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe( |
| 98 | + 'C:\\Users\\foo\\file.txt', |
| 99 | + ) |
| 100 | + }) |
| 101 | + |
| 102 | + test('preserves relative paths (just flips slashes)', () => { |
| 103 | + // Relative paths are not MinGW absolute paths; the conversion |
| 104 | + // should be a no-op aside from slash direction. The path is then |
| 105 | + // resolved against cwd by `validatePath`, which is expected behavior. |
| 106 | + const result = validatePath( |
| 107 | + 'src/file.txt', |
| 108 | + 'D:\\project', |
| 109 | + makeContext(), |
| 110 | + 'read', |
| 111 | + ) |
| 112 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe( |
| 113 | + 'D:\\project\\src\\file.txt', |
| 114 | + ) |
| 115 | + }) |
| 116 | + |
| 117 | + test('handles bare drive mount (no trailing path)', () => { |
| 118 | + const result = validatePath('/c', 'D:\\project', makeContext(), 'read') |
| 119 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe('C:\\') |
| 120 | + }) |
| 121 | + |
| 122 | + test('handles drive root with trailing slash', () => { |
| 123 | + const result = validatePath('/c/', 'D:\\project', makeContext(), 'read') |
| 124 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe('C:\\') |
| 125 | + }) |
| 126 | + |
| 127 | + test('handles deeply nested MinGW paths', () => { |
| 128 | + const result = validatePath( |
| 129 | + '/c/Users/me/Documents/project/src/index.ts', |
| 130 | + 'D:\\project', |
| 131 | + makeContext(), |
| 132 | + 'read', |
| 133 | + ) |
| 134 | + expect(result.resolvedPath.replace(/\//g, '\\')).toBe( |
| 135 | + 'C:\\Users\\me\\Documents\\project\\src\\index.ts', |
| 136 | + ) |
| 137 | + }) |
| 138 | +}) |
| 139 | + |
| 140 | +// ─── Sandbox escape regression (Windows) ───────────────────────────────── |
| 141 | +// |
| 142 | +// This is the bug the MinGW-normalization fix exists to prevent: without |
| 143 | +// it, the validator compares `<currentDrive>:\c\Users\foo\file.txt` against |
| 144 | +// the allowed dirs, while bash writes to `C:\Users\foo\file.txt`. With the |
| 145 | +// fix, both sides of the comparison use the same `C:\Users\foo\file.txt` |
| 146 | +// location. |
| 147 | +// |
| 148 | +// We pin this by setting up a context where: |
| 149 | +// - cwd is `D:\project` (and D:\project is allowed) |
| 150 | +// - `C:\Users\foo` is NOT in any allowed directory |
| 151 | +// Then we check that `/c/Users/foo/sensitive.txt` is denied with a |
| 152 | +// resolvedPath pointing at C:\Users\foo — proving the validator now sees |
| 153 | +// the same path the shell will write to. |
| 154 | +describeIfWindows('validatePath sandbox escape regression', () => { |
| 155 | + test('MinGW path that escapes allowed dirs is denied at correct location', () => { |
| 156 | + // Without the fix, this would resolve to `D:\c\Users\foo\sensitive.txt` |
| 157 | + // and (if D:\ is broadly allowed) pass validation, while bash actually |
| 158 | + // writes to `C:\Users\foo\sensitive.txt`. With the fix, the validator |
| 159 | + // sees the correct path and denies it because C:\Users\foo is not in |
| 160 | + // any allowed directory. |
| 161 | + const result = validatePath( |
| 162 | + '/c/Users/foo/sensitive.txt', |
| 163 | + 'D:\\project', |
| 164 | + makeContext(), |
| 165 | + 'create', |
| 166 | + ) |
| 167 | + expect(result.allowed).toBe(false) |
| 168 | + // The resolvedPath should be at C:\Users\foo — not D:\c\Users\foo. |
| 169 | + const normalized = result.resolvedPath.replace(/\//g, '\\') |
| 170 | + expect(normalized.startsWith('C:\\Users\\foo')).toBe(true) |
| 171 | + expect(normalized.startsWith('D:\\c\\')).toBe(false) |
| 172 | + }) |
| 173 | + |
| 174 | + test('cygdrive path that escapes allowed dirs is denied at correct location', () => { |
| 175 | + const result = validatePath( |
| 176 | + '/cygdrive/c/Users/foo/sensitive.txt', |
| 177 | + 'D:\\project', |
| 178 | + makeContext(), |
| 179 | + 'create', |
| 180 | + ) |
| 181 | + expect(result.allowed).toBe(false) |
| 182 | + const normalized = result.resolvedPath.replace(/\//g, '\\') |
| 183 | + expect(normalized.startsWith('C:\\Users\\foo')).toBe(true) |
| 184 | + }) |
| 185 | +}) |
0 commit comments