diff options
| -rw-r--r-- | src/manifest.rs | 15 | ||||
| -rw-r--r-- | tests/compare.rs | 23 |
2 files changed, 38 insertions, 0 deletions
diff --git a/src/manifest.rs b/src/manifest.rs index bc09073..a68245b 100644 --- a/src/manifest.rs +++ b/src/manifest.rs @@ -32,6 +32,7 @@ impl ArtifactManifest { services.sort_by(|left, right| left.name.cmp(&right.name)); archive_members.sort_by(|left, right| left.path.cmp(&right.path)); validate_file_records(&files)?; + validate_manifest_paths(&files, initrd.as_ref(), &archive_members)?; ensure_unique("package", packages.iter().map(|record| record.name.as_str()))?; ensure_unique("file", files.iter().map(|record| record.path.as_str()))?; ensure_unique("service", services.iter().map(|record| record.name.as_str()))?; @@ -356,6 +357,20 @@ fn link_target(path: &Path) -> Result<String> { Ok(value.to_owned()) } +fn validate_manifest_paths( + files: &[FileRecord], + initrd: Option<&InitrdRecord>, + archive_members: &[ArchiveMemberRecord], +) -> Result<()> { + for path in files.iter().map(|record| record.path.as_str()).chain(archive_members.iter().map(|record| record.path.as_str())) { + portable_path(Path::new(path))?; + } + if let Some(initrd) = initrd { + portable_path(Path::new(&initrd.path))?; + } + Ok(()) +} + fn validate_file_records(records: &[FileRecord]) -> Result<()> { for record in records { match record.kind.as_str() { diff --git a/tests/compare.rs b/tests/compare.rs index 45522d1..17342c3 100644 --- a/tests/compare.rs +++ b/tests/compare.rs @@ -206,6 +206,29 @@ fn rejects_malformed_file_records_before_comparison() { } #[test] +fn rejects_non_portable_manifest_paths_before_comparison() { + let error = ArtifactManifest::new( + vec![], + vec![FileRecord::file("../etc/controller.conf", "digest")], + None, + vec![], + vec![], + ) + .expect_err("parent paths must not enter a semantic manifest"); + assert!(error.to_string().contains("parent path is not valid")); + + let error = ArtifactManifest::new( + vec![], + vec![], + Some(InitrdRecord::new("/boot/initrd-rt.img", "digest")), + vec![], + vec![], + ) + .expect_err("absolute initrd paths must not enter a semantic manifest"); + assert!(error.to_string().contains("absolute path is not valid")); +} + +#[test] fn collects_semantic_facts_from_native_rootfs_and_tar_artifact() { let fixture = tempdir().expect("temporary directory"); let rootfs = fixture.path().join("rootfs"); |