37 lines
774 B
Go
37 lines
774 B
Go
package internal
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestSafeJoinWithinRoot(t *testing.T) {
|
|
root := t.TempDir()
|
|
got, err := SafeJoin(root, "folder/file.txt")
|
|
if err != nil {
|
|
t.Fatalf("SafeJoin failed: %v", err)
|
|
}
|
|
want := filepath.Join(root, "folder", "file.txt")
|
|
if got != want {
|
|
t.Fatalf("SafeJoin mismatch got=%q want=%q", got, want)
|
|
}
|
|
}
|
|
|
|
func TestSafeJoinRejectsEscape(t *testing.T) {
|
|
root := t.TempDir()
|
|
if _, err := SafeJoin(root, "../etc/passwd"); err == nil {
|
|
t.Fatalf("expected escape rejection")
|
|
}
|
|
}
|
|
|
|
func TestSafeJoinAllowsRoot(t *testing.T) {
|
|
root := t.TempDir()
|
|
got, err := SafeJoin(root, "")
|
|
if err != nil {
|
|
t.Fatalf("SafeJoin root failed: %v", err)
|
|
}
|
|
if got != root {
|
|
t.Fatalf("expected root path %q got %q", root, got)
|
|
}
|
|
}
|