Compare commits
2 Commits
fix/issue-
...
fix/issue-
| Author | SHA1 | Date | |
|---|---|---|---|
| 8d13242c32 | |||
|
|
94a4e60c17 |
@@ -113,7 +113,7 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
|
|||||||
return fmt.Errorf("invalid path in manifest: %w", err)
|
return fmt.Errorf("invalid path in manifest: %w", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
fileURL := baseURL.String() + encodeFilePath(f.Path)
|
fileURL := baseURL.String() + f.Path
|
||||||
log.Infof("fetching %s", f.Path)
|
log.Infof("fetching %s", f.Path)
|
||||||
|
|
||||||
if err := downloadFile(fileURL, localPath, f, progress); err != nil {
|
if err := downloadFile(fileURL, localPath, f, progress); err != nil {
|
||||||
@@ -139,15 +139,6 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// encodeFilePath URL-encodes each segment of a file path while preserving slashes.
|
|
||||||
func encodeFilePath(p string) string {
|
|
||||||
segments := strings.Split(p, "/")
|
|
||||||
for i, seg := range segments {
|
|
||||||
segments[i] = url.PathEscape(seg)
|
|
||||||
}
|
|
||||||
return strings.Join(segments, "/")
|
|
||||||
}
|
|
||||||
|
|
||||||
// sanitizePath validates and sanitizes a file path from the manifest.
|
// sanitizePath validates and sanitizes a file path from the manifest.
|
||||||
// It prevents path traversal attacks and rejects unsafe paths.
|
// It prevents path traversal attacks and rejects unsafe paths.
|
||||||
func sanitizePath(p string) (string, error) {
|
func sanitizePath(p string) (string, error) {
|
||||||
|
|||||||
@@ -16,29 +16,6 @@ import (
|
|||||||
"sneak.berlin/go/mfer/mfer"
|
"sneak.berlin/go/mfer/mfer"
|
||||||
)
|
)
|
||||||
|
|
||||||
func TestEncodeFilePath(t *testing.T) {
|
|
||||||
tests := []struct {
|
|
||||||
input string
|
|
||||||
expected string
|
|
||||||
}{
|
|
||||||
{"file.txt", "file.txt"},
|
|
||||||
{"dir/file.txt", "dir/file.txt"},
|
|
||||||
{"my file.txt", "my%20file.txt"},
|
|
||||||
{"dir/my file.txt", "dir/my%20file.txt"},
|
|
||||||
{"file#1.txt", "file%231.txt"},
|
|
||||||
{"file?v=1.txt", "file%3Fv=1.txt"},
|
|
||||||
{"path/to/file with spaces.txt", "path/to/file%20with%20spaces.txt"},
|
|
||||||
{"100%done.txt", "100%25done.txt"},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.input, func(t *testing.T) {
|
|
||||||
result := encodeFilePath(tt.input)
|
|
||||||
assert.Equal(t, tt.expected, result)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestSanitizePath(t *testing.T) {
|
func TestSanitizePath(t *testing.T) {
|
||||||
// Valid paths that should be accepted
|
// Valid paths that should be accepted
|
||||||
validTests := []struct {
|
validTests := []struct {
|
||||||
|
|||||||
@@ -92,29 +92,6 @@ func TestBuilderBuild(t *testing.T) {
|
|||||||
assert.True(t, strings.HasPrefix(buf.String(), MAGIC))
|
assert.True(t, strings.HasPrefix(buf.String(), MAGIC))
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestNewTimestampFromTimeExtremeDate(t *testing.T) {
|
|
||||||
// Regression test: newTimestampFromTime used UnixNano() which panics
|
|
||||||
// for dates outside ~1678-2262. Now uses Nanosecond() which is safe.
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
time time.Time
|
|
||||||
}{
|
|
||||||
{"zero time", time.Time{}},
|
|
||||||
{"year 1000", time.Date(1000, 1, 1, 0, 0, 0, 0, time.UTC)},
|
|
||||||
{"year 3000", time.Date(3000, 1, 1, 0, 0, 0, 123456789, time.UTC)},
|
|
||||||
{"unix epoch", time.Unix(0, 0)},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
// Should not panic
|
|
||||||
ts := newTimestampFromTime(tt.time)
|
|
||||||
assert.Equal(t, tt.time.Unix(), ts.Seconds)
|
|
||||||
assert.Equal(t, int32(tt.time.Nanosecond()), ts.Nanos)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestBuilderBuildEmpty(t *testing.T) {
|
func TestBuilderBuildEmpty(t *testing.T) {
|
||||||
b := NewBuilder()
|
b := NewBuilder()
|
||||||
|
|
||||||
|
|||||||
@@ -16,10 +16,11 @@ import (
|
|||||||
const MAGIC string = "ZNAVSRFG"
|
const MAGIC string = "ZNAVSRFG"
|
||||||
|
|
||||||
func newTimestampFromTime(t time.Time) *Timestamp {
|
func newTimestampFromTime(t time.Time) *Timestamp {
|
||||||
return &Timestamp{
|
out := &Timestamp{
|
||||||
Seconds: t.Unix(),
|
Seconds: t.Unix(),
|
||||||
Nanos: int32(t.Nanosecond()),
|
Nanos: int32(t.UnixNano() - (t.Unix() * 1000000000)),
|
||||||
}
|
}
|
||||||
|
return out
|
||||||
}
|
}
|
||||||
|
|
||||||
func (m *manifest) generate() error {
|
func (m *manifest) generate() error {
|
||||||
|
|||||||
Reference in New Issue
Block a user