test: specify download escape side effects · openclaw/openclaw@34cbc13
shakkernerd
·
2026-05-12
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -166,18 +166,25 @@ beforeEach(() => {
|
166 | 166 | describe("installDownloadSpec extraction safety", () => { |
167 | 167 | it("rejects targetDir escapes outside the per-skill tools root", async () => { |
168 | 168 | const beforeFetchCalls = fetchWithSsrFGuardMock.mock.calls.length; |
| 169 | +const entry = buildEntry("relative-traversal"); |
| 170 | +const toolsRoot = resolveSkillToolsRootDir(entry); |
| 171 | +const escapedTargetDir = path.resolve(toolsRoot, "../outside"); |
169 | 172 | |
170 | | -const result = await installDownloadSkill({ |
171 | | -name: "relative-traversal", |
172 | | -url: "https://example.invalid/good.zip", |
173 | | -archive: "zip", |
174 | | -targetDir: "../outside", |
| 173 | +const result = await installDownloadSpec({ |
| 174 | + entry, |
| 175 | +spec: buildDownloadSpec({ |
| 176 | +url: "https://example.invalid/good.zip", |
| 177 | +archive: "zip", |
| 178 | +targetDir: "../outside", |
| 179 | +}), |
| 180 | +timeoutMs: 30_000, |
175 | 181 | }); |
176 | 182 | |
177 | 183 | expect(result.ok).toBe(false); |
178 | 184 | expect(result.stderr).toContain("Refusing to install outside the skill tools directory"); |
179 | 185 | expect(fetchWithSsrFGuardMock.mock.calls.length).toBe(beforeFetchCalls); |
180 | | -expect(stateDir.length).toBeGreaterThan(0); |
| 186 | +await expect(fileExists(toolsRoot)).resolves.toBe(true); |
| 187 | +await expect(fileExists(escapedTargetDir)).resolves.toBe(false); |
181 | 188 | }); |
182 | 189 | |
183 | 190 | it("allows relative targetDir inside the per-skill tools root", async () => { |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
