morozovsa/launcher-next
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bound catalog acquisition before pilot staging

Browse Source
This commit is contained in:
codex
2026-08-05 13:21:51 +03:00
parent b83742b3a5
commit d4a4d9acf8
4 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Launcher.Next.Tests/RosterAdaptersTests.cs
+12
View File
@@ -82,5 +82,17 @@ public sealed class RosterAdaptersTests
finally { Directory.Delete(root,true); }
}
[Fact]
public async Task FileSystemCatalog_RejectsTraversalInManifest()
{
var root=Path.Combine(Path.GetTempPath(),Guid.NewGuid().ToString("N")); var packageRoot=Path.Combine(root,"P_A","1.0.0"); Directory.CreateDirectory(packageRoot);
try
{
await File.WriteAllTextAsync(Path.Combine(packageRoot,"package.manifest.json"), """{"schemaVersion":1,"packageId":"P_A","version":"1.0.0","product":"Plant3D","productYear":2026,"architecture":"x64","entryAssembly":"entry.dll","files":[{"path":"../outside.dll","length":1,"sha256":"00"}],"startup":{"type":"netload","command":"P_A"},"rolloutChannel":"stable"}""");
Assert.Null(await new FileSystemCatalogPackageAcquirer(root).AcquireAsync(new("P_A","Plant3D",2026,"x64","stable","1.0.0","project-a",true),CancellationToken.None));
}
finally { Directory.Delete(root,true); }
}
private static string Json() => """{"schemaVersion":1,"rosterId":"project-a","product":"Plant3D","year":2026,"architecture":"x64","offlinePolicy":"AllowVerifiedLastKnownGood","packages":[{"id":"P_B","version":"2.0.0","channel":"stable","loadOrder":200},{"id":"P_A","version":"1.0.0","channel":"stable","loadOrder":100}]}""";
}