Open History to see the last commit
1import { NodeHttpServer, NodeServices } from "@effect/platform-node";
2import { assert, it } from "@effect/vitest";
3import * as Effect from "effect/Effect";
4import * as FileSystem from "effect/FileSystem";
5import * as Layer from "effect/Layer";
6import * as Path from "effect/Path";
7import { HttpClient, HttpRouter } from "effect/http";
8
9import { makeMockUpdateRouteLayer } from "./mock-update-server.ts";
10import { symlinksSupported } from "@t3tools/shared/testing/symlinks";
11
12const withMockUpdateServer = <A, E, R>(rootRealPath: string, effect: Effect.Effect<A, E, R>) =>
13 effect.pipe(
14 Effect.provide(
15 HttpRouter.serve(makeMockUpdateRouteLayer(rootRealPath), {
16 disableListenLog: true,
17 disableLogger: true,
18 }).pipe(Layer.provideMerge(NodeHttpServer.layerTest)),
19 ),
20 );
21
22it.layer(NodeServices.layer)("mock-update-server", (it) => {
23 it.effect("rejects encoded path traversal outside the configured root", () =>
24 Effect.gen(function* () {
25 const fileSystem = yield* FileSystem.FileSystem;
26 const path = yield* Path.Path;
27 const root = yield* fileSystem.makeTempDirectoryScoped({
28 prefix: "mock-update-server-root-",
29 });
30 const outside = yield* fileSystem.makeTempDirectoryScoped({
31 prefix: "mock-update-server-outside-",
32 });
33 const rootRealPath = yield* fileSystem.realPath(root);
34
35 yield* fileSystem.writeFileString(path.join(outside, "secret.txt"), "nope\n");
36
37 yield* withMockUpdateServer(
38 rootRealPath,
39 Effect.gen(function* () {
40 const client = yield* HttpClient.HttpClient;
41 const response = yield* client.get("/%2e%2e/secret.txt");
42
43 assert.equal(response.status, 404);
44 assert.equal(yield* response.text, "Not Found");
45 }),
46 );
47 }),
48 );
49
50 it.effect.skipIf(!symlinksSupported)(
51 "rejects symlinked files that escape the configured root",
52 () =>
53 Effect.gen(function* () {
54 const fileSystem = yield* FileSystem.FileSystem;
55 const path = yield* Path.Path;
56 const root = yield* fileSystem.makeTempDirectoryScoped({
57 prefix: "mock-update-server-root-",
58 });
59 const outside = yield* fileSystem.makeTempDirectoryScoped({
60 prefix: "mock-update-server-outside-",
61 });
62 const rootRealPath = yield* fileSystem.realPath(root);
63 const outsideFile = path.join(outside, "outside.yml");
64 const linksDir = path.join(root, "links");
65 const symlinkPath = path.join(linksDir, "outside.yml");
66
67 yield* fileSystem.writeFileString(outsideFile, "version: outside\n");
68 yield* fileSystem.makeDirectory(linksDir, { recursive: true });
69 yield* fileSystem.symlink(outsideFile, symlinkPath);
70
71 yield* withMockUpdateServer(
72 rootRealPath,
73 Effect.gen(function* () {
74 const client = yield* HttpClient.HttpClient;
75 const response = yield* client.get("/links/outside.yml");
76
77 assert.equal(response.status, 404);
78 assert.equal(yield* response.text, "Not Found");
79 }),
80 );
81 }),
82 );
83});