admin
bb60c06c0e
Container-Image veröffentlichen / container (push) v1.4.0 wurde manuell veröffentlicht und verifiziert
54 lines
1.5 KiB
Go
54 lines
1.5 KiB
Go
package updateagent
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"log/slog"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestValidateServerConfigRejectsUnsafeSocketPaths(t *testing.T) {
|
|
t.Parallel()
|
|
valid := ServerConfig{
|
|
Socket: "/run/domain-control-update/agent.sock",
|
|
DockerSocket: "/var/run/docker.sock",
|
|
ImageRepository: defaultImageRepository,
|
|
TargetLabel: "de.j-mahler.domain-control.role=app",
|
|
}
|
|
if err := validateServerConfig(valid); err != nil {
|
|
t.Fatalf("valid config rejected: %v", err)
|
|
}
|
|
for _, socket := range []string{"agent.sock", "/agent.sock", "/var/run/docker.sock"} {
|
|
candidate := valid
|
|
candidate.Socket = socket
|
|
if err := validateServerConfig(candidate); err == nil {
|
|
t.Errorf("unsafe socket path %q was accepted", socket)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestServeDoesNotDeleteRegularFileAtSocketPath(t *testing.T) {
|
|
t.Parallel()
|
|
directory := t.TempDir()
|
|
socket := filepath.Join(directory, "agent.sock")
|
|
if err := os.WriteFile(socket, []byte("keep"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
config := ServerConfig{
|
|
Socket: socket,
|
|
DockerSocket: "/var/run/docker.sock",
|
|
ImageRepository: defaultImageRepository,
|
|
TargetLabel: "de.j-mahler.domain-control.role=app",
|
|
}
|
|
err := Serve(context.Background(), config, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
|
if err == nil {
|
|
t.Fatal("regular file at the socket path was silently replaced")
|
|
}
|
|
content, readErr := os.ReadFile(socket)
|
|
if readErr != nil || string(content) != "keep" {
|
|
t.Fatalf("regular file was changed: content=%q err=%v", content, readErr)
|
|
}
|
|
}
|