Jade Lovelaceandeldritch horrors
d46adb45eb
Apparently we had zero test coverage of this, let's fix that. Change-Id: I00c906daf5acfc01913562036ca88abbf63dd3d9
68 lines
2.4 KiB
Python
68 lines
2.4 KiB
Python
from pathlib import Path
|
|
from textwrap import dedent
|
|
from functional2.testlib.fixtures import Nix
|
|
import re
|
|
|
|
|
|
def test_purity_traversal(nix: Nix, tmp_path: Path):
|
|
ERROR_RE = re.compile(r"error: access to absolute path '.+' is forbidden in pure eval mode")
|
|
|
|
flake_dir = tmp_path / 'flake'
|
|
flake_dir.mkdir()
|
|
|
|
evilpath = tmp_path / 'sekrit.txt'
|
|
evilpath.write_text('kitty kitty')
|
|
|
|
evilnix = tmp_path / 'default.nix'
|
|
evilnix.write_text('"woof"')
|
|
|
|
goodnix = flake_dir / 'good.nix'
|
|
goodnix.write_text("1")
|
|
|
|
nested_dir = flake_dir / 'nested' / 'nested2'
|
|
nested_dir.mkdir(parents=True)
|
|
(nested_dir / 'good.nix').write_text("1")
|
|
|
|
(flake_dir / 'evil-link').symlink_to(evilpath)
|
|
(flake_dir / 'evil-default-nix').symlink_to(tmp_path)
|
|
(flake_dir / 'less-evil-link').symlink_to(tmp_path / 'link-to-flake')
|
|
(tmp_path / 'link-to-flake').symlink_to(flake_dir / 'flake.nix')
|
|
|
|
(flake_dir / 'nested-good.nix').symlink_to('nested/nested2/good.nix')
|
|
(flake_dir / 'nested-bad.nix').symlink_to('nested/../../nested2/good.nix')
|
|
|
|
(flake_dir / 'flake.nix').write_text(dedent("""
|
|
{
|
|
inputs = {};
|
|
outputs = inputs: {
|
|
bad1 = "${@ABSPATH@}";
|
|
bad2 = builtins.readFile "${@ABSPATH@}";
|
|
bad3 = builtins.readFile @ABSPATH@;
|
|
bad4 = builtins.readFile ./evil-link;
|
|
bad5 = builtins.readFile "${./evil-link}";
|
|
bad6 = builtins.readFile ./less-evil-link;
|
|
bad7 = builtins.readFile "${./less-evil-link}";
|
|
bad8 = import ./evil-default-nix;
|
|
bad9 = import ./nested-bad.nix;
|
|
|
|
good1 = builtins.readFile "${inputs.self.outPath}/good.nix";
|
|
good2 = builtins.readFile ./good.nix;
|
|
good3 = builtins.readFile "${./good.nix}";
|
|
good4 = toString (import ./good.nix);
|
|
good5 = toString (import ./nested-good.nix);
|
|
};
|
|
}
|
|
""").replace('@ABSPATH@', str(evilpath.absolute())))
|
|
|
|
for idx in range(1, 10):
|
|
cmd = nix.nix(['eval', f'.#bad{idx}'], flake=True)
|
|
cmd.cwd = flake_dir
|
|
res = cmd.run().expect(1)
|
|
print(res.stderr_plain)
|
|
assert ERROR_RE.search(res.stderr_plain)
|
|
for idx in range(1, 6):
|
|
cmd = nix.nix(['eval', f'.#good{idx}'], flake=True)
|
|
cmd.cwd = flake_dir
|
|
res = cmd.run().expect(0)
|
|
assert res.stdout_plain == '"1"'
|