27 lines
1.0 KiB
TypeScript
27 lines
1.0 KiB
TypeScript
import path from 'path';
|
||
import { describe, it, expect } from 'vitest';
|
||
import { isPathInside } from '../path-security';
|
||
|
||
const base = path.resolve('C:/data/clone');
|
||
|
||
describe('TC-PATH · 路径边界判定（§7.3 / H2）', () => {
|
||
it('TC-PATH-01: 目标等于基目录 → 允许', () => {
|
||
expect(isPathInside(base, base)).toBe(true);
|
||
});
|
||
|
||
it('TC-PATH-02: 目标在基目录内（含多级）→ 允许', () => {
|
||
expect(isPathInside(base, path.join(base, 'abc'))).toBe(true);
|
||
expect(isPathInside(base, path.join(base, 'a/b/c'))).toBe(true);
|
||
});
|
||
|
||
it('TC-PATH-03: 兄弟目录（前缀相似）→ 拒绝（startsWith 绕过回归）', () => {
|
||
expect(isPathInside(base, base + '2')).toBe(false); // clone2
|
||
expect(isPathInside(base, base + '-evil')).toBe(false); // clone-evil
|
||
});
|
||
|
||
it('TC-PATH-04: 上级目录/绝对越界 → 拒绝', () => {
|
||
expect(isPathInside(base, path.resolve(base, '..'))).toBe(false);
|
||
expect(isPathInside(base, path.resolve(base, '../../x'))).toBe(false);
|
||
});
|
||
});
|