Spaces:
Running
Running
File size: 2,525 Bytes
3b2bae1 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 | import stat
import tempfile
import unittest
import zipfile
from pathlib import Path
from chinatravel.ui.archive import SubmissionArchiveError, extract_submission_archive
class SubmissionArchiveTests(unittest.TestCase):
def _archive(self, root, entries):
path = Path(root) / "submission.zip"
with zipfile.ZipFile(path, "w") as archive:
for name, value in entries:
if isinstance(value, zipfile.ZipInfo):
archive.writestr(value, "target")
else:
archive.writestr(name, value)
return path
def test_extracts_json_from_outer_directory(self):
with tempfile.TemporaryDirectory() as root:
archive = self._archive(
root,
[
("team/uid-1.json", "{}"),
("team/README.txt", "ignored"),
("__MACOSX/._uid-1.json", "ignored"),
],
)
output = Path(root) / "output"
summary = extract_submission_archive(archive, output)
self.assertEqual(summary.json_files, 1)
self.assertEqual((output / "team" / "uid-1.json").read_text(), "{}")
self.assertFalse((output / "team" / "README.txt").exists())
def test_rejects_parent_path(self):
with tempfile.TemporaryDirectory() as root:
archive = self._archive(root, [("../uid.json", "{}")])
with self.assertRaisesRegex(SubmissionArchiveError, "Unsafe archive path"):
extract_submission_archive(archive, Path(root) / "output")
def test_rejects_duplicate_uid_filenames(self):
with tempfile.TemporaryDirectory() as root:
archive = self._archive(
root,
[("first/uid.json", "{}"), ("second/uid.json", "{}")],
)
with self.assertRaisesRegex(SubmissionArchiveError, "Duplicate"):
extract_submission_archive(archive, Path(root) / "output")
def test_rejects_symbolic_link(self):
with tempfile.TemporaryDirectory() as root:
link = zipfile.ZipInfo("uid.json")
link.create_system = 3
link.external_attr = (stat.S_IFLNK | 0o777) << 16
archive = self._archive(root, [("uid.json", link)])
with self.assertRaisesRegex(SubmissionArchiveError, "Symbolic links"):
extract_submission_archive(archive, Path(root) / "output")
if __name__ == "__main__":
unittest.main()
|