test_cli_injection.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests for CLI path traversal and injection.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from pathlib import Path |
| 6 | |
| 7 | import pytest |
| 8 | |
| 9 | from adapters.errors import ConfigError |
| 10 | from adapters.templating import substitute_tokens |
| 11 | from cli.paths import PathEscapeError, confine_path |
| 12 | from tests.support import run_cli |
| 13 | |
| 14 | |
| 15 | def test_confine_path_rejects_escape(tmp_path: Path) -> None: |
| 16 | with pytest.raises(PathEscapeError): |
| 17 | confine_path(tmp_path, "../outside") |
| 18 | |
| 19 | |
| 20 | def test_unknown_template_token_fails_closed() -> None: |
| 21 | with pytest.raises(ConfigError): |
| 22 | substitute_tokens("{{evil.token}}", {"repo.name": "x"}, fail_on_unknown=True) |
| 23 | |
| 24 | |
| 25 | def test_init_outside_repo_config_refused(tmp_path: Path) -> None: |
| 26 | repo = tmp_path / "repo" |
| 27 | repo.mkdir() |
| 28 | code = run_cli( |
| 29 | [ |
| 30 | "init", |
| 31 | "--regime", |
| 32 | "git-only", |
| 33 | "--non-interactive", |
| 34 | "--config", |
| 35 | "../outside/config.yaml", |
| 36 | ], |
| 37 | cwd=repo, |
| 38 | ) |
| 39 | assert code == 4 |