fn test_check_valid_input_files()

in codex-rs/execpolicy/src/execv_checker.rs [165:281]

• 98 lines of code
• 1 McCabe index (conditional complexity)

    fn test_check_valid_input_files() -> Result<()> {
        let temp_dir = TempDir::new().unwrap();

        // Create an executable file that can be used with the system_path arg.
        let fake_cp = temp_dir.path().join("cp");
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;

            let fake_cp_file = std::fs::File::create(&fake_cp).unwrap();
            let mut permissions = fake_cp_file.metadata().unwrap().permissions();
            permissions.set_mode(0o755);
            std::fs::set_permissions(&fake_cp, permissions).unwrap();
        }
        #[cfg(windows)]
        {
            std::fs::File::create(&fake_cp).unwrap();
        }

        // Create root_path and reference to files under the root.
        let root_path = temp_dir.path().to_path_buf();
        let source_path = root_path.join("source");
        let dest_path = root_path.join("dest");

        let cp = fake_cp.to_str().unwrap().to_string();
        let root = root_path.to_str().unwrap().to_string();
        let source = source_path.to_str().unwrap().to_string();
        let dest = dest_path.to_str().unwrap().to_string();

        let cwd = Some(root_path.clone().into());

        let checker = setup(&fake_cp);
        let exec_call = ExecCall {
            program: "cp".into(),
            args: vec![source.clone(), dest.clone()],
        };
        let valid_exec = match checker.r#match(&exec_call)? {
            MatchedExec::Match { exec } => exec,
            unexpected => panic!("Expected a safe exec but got {unexpected:?}"),
        };

        // No readable or writeable folders specified.
        assert_eq!(
            checker.check(valid_exec.clone(), &cwd, &[], &[]),
            Err(ReadablePathNotInReadableFolders {
                file: source_path.clone(),
                folders: vec![]
            }),
        );

        // Only readable folders specified.
        assert_eq!(
            checker.check(valid_exec.clone(), &cwd, &[root_path.clone()], &[]),
            Err(WriteablePathNotInWriteableFolders {
                file: dest_path.clone(),
                folders: vec![]
            }),
        );

        // Both readable and writeable folders specified.
        assert_eq!(
            checker.check(
                valid_exec.clone(),
                &cwd,
                &[root_path.clone()],
                &[root_path.clone()]
            ),
            Ok(cp.clone()),
        );

        // Args are the readable and writeable folders, not files within the
        // folders.
        let exec_call_folders_as_args = ExecCall {
            program: "cp".into(),
            args: vec![root.clone(), root.clone()],
        };
        let valid_exec_call_folders_as_args = match checker.r#match(&exec_call_folders_as_args)? {
            MatchedExec::Match { exec } => exec,
            _ => panic!("Expected a safe exec"),
        };
        assert_eq!(
            checker.check(
                valid_exec_call_folders_as_args,
                &cwd,
                &[root_path.clone()],
                &[root_path.clone()]
            ),
            Ok(cp.clone()),
        );

        // Specify a parent of a readable folder as input.
        let exec_with_parent_of_readable_folder = ValidExec {
            program: "cp".into(),
            args: vec![
                MatchedArg::new(
                    0,
                    ArgType::ReadableFile,
                    root_path.parent().unwrap().to_str().unwrap(),
                )?,
                MatchedArg::new(1, ArgType::WriteableFile, &dest)?,
            ],
            ..Default::default()
        };
        assert_eq!(
            checker.check(
                exec_with_parent_of_readable_folder,
                &cwd,
                &[root_path.clone()],
                &[dest_path.clone()]
            ),
            Err(ReadablePathNotInReadableFolders {
                file: root_path.parent().unwrap().to_path_buf(),
                folders: vec![root_path.clone()]
            }),
        );
        Ok(())
    }