Files
container/Tests/ContainerizationOCITests/LocalContentStoreTests.swift
T
c0185aea5c Improve security across containerization (#898)
This PR fixes a number of issues: 
- validate descriptor digests before filesystem use
- validate container and exec ids before building paths in
ManagedContainer
- Check for attribute length when consuming extended attributes in
ContainerizationEXT4
- Check directory name length when formatting an ext4 fs
- Prevent OCI image layout load from reading host files through a
symlink
- Validate registry auth realm before exchanging credentials

---------

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Co-authored-by: John Logan <john_logan@apple.com>
Co-authored-by: Raj Aryan Singh <rajaryan_singh@apple.com>
Co-authored-by: Raj <realrajaryan@gmail.com>
2026-08-28 13:22:06 -07:00

87 lines
3.5 KiB
Swift

//===----------------------------------------------------------------------===//
// Copyright © 2026 Apple Inc. and the Containerization project authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//===----------------------------------------------------------------------===//
import Foundation
import Testing
@testable import ContainerizationOCI
@Suite
struct LocalContentStoreTests {
private static let digestA = String(repeating: "a", count: 64)
private static let digestB = String(repeating: "b", count: 64)
@Test func totalAllocatedSizeReportsZeroForEmptyStore() async throws {
let dir = FileManager.default.uniqueTemporaryDirectory(create: true)
defer { try? FileManager.default.removeItem(at: dir) }
let store = try LocalContentStore(path: dir)
let size = try await store.totalAllocatedSize()
#expect(size == 0)
}
@Test func totalAllocatedSizeReflectsCommittedBlobs() async throws {
let dir = FileManager.default.uniqueTemporaryDirectory(create: true)
defer { try? FileManager.default.removeItem(at: dir) }
let store = try LocalContentStore(path: dir)
let payload = Data(repeating: 0xAB, count: 64 * 1024)
try await store.ingest { tempDir in
try payload.write(to: tempDir.appendingPathComponent(Self.digestA))
}
let size = try await store.totalAllocatedSize()
#expect(size >= UInt64(payload.count))
}
@Test func totalAllocatedSizeIncludesInFlightIngest() async throws {
let dir = FileManager.default.uniqueTemporaryDirectory(create: true)
defer { try? FileManager.default.removeItem(at: dir) }
let store = try LocalContentStore(path: dir)
let payload = Data(repeating: 0xCD, count: 32 * 1024)
let session = try await store.newIngestSession()
try payload.write(to: session.ingestDir.appendingPathComponent(Self.digestB))
let size = try await store.totalAllocatedSize()
#expect(size >= UInt64(payload.count))
try await store.cancelIngestSession(session.id)
}
@Test func completeIngestSessionRejectsSymlinkedEntry() async throws {
let dir = FileManager.default.uniqueTemporaryDirectory(create: true)
defer { try? FileManager.default.removeItem(at: dir) }
let store = try LocalContentStore(path: dir)
let outsideTarget = dir.appendingPathComponent("outside-\(UUID().uuidString)")
try Data("outside contents".utf8).write(to: outsideTarget)
let session = try await store.newIngestSession()
let link = session.ingestDir.appendingPathComponent(Self.digestA)
try FileManager.default.createSymbolicLink(at: link, withDestinationURL: outsideTarget)
await #expect(throws: (any Error).self) {
try await store.completeIngestSession(session.id)
}
let blobPath = dir.appendingPathComponent("blobs/sha256").appendingPathComponent(Self.digestA)
#expect(!FileManager.default.fileExists(atPath: blobPath.path))
}
}