starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-20 00:03:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: cover sftp upload root sibling rejection

Browse Source 
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Jinwoo-H
2026-05-30 07:02:20 -07:00
co-authored by Orca
parent e543b711e0
commit d43f6f110a
1 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/ssh/sftp-upload.test.ts
+17
View File
@@ -66,6 +66,23 @@ describe('sftp-upload', () => {
})
})
it('rejects sibling directories outside the upload root', async () => {
const localDir = await mkdtemp(join(tmpdir(), 'orca-sftp-upload-'))
const escapedDir = `${localDir}-sibling`
await mkdir(escapedDir)
await writeFile(join(escapedDir, 'asset.txt'), 'asset')
const sftp = createSftpMock()
await expect(
uploadDirectory(sftp, escapedDir, '/remote/assets', await realpath(localDir), {
exclusive: true
})
).rejects.toThrow('Path escaped upload root')
expect(sftp.mkdir).not.toHaveBeenCalled()
expect(sftp.createWriteStream).not.toHaveBeenCalled()
})
it('does not create the remote file when the local source is a symlink', async () => {
const localDir = await mkdtemp(join(tmpdir(), 'orca-sftp-upload-'))
await writeFile(join(localDir, 'target.txt'), 'secret')