X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/44c95f99098fa6c6acbfa82d4b6cbc6015eb6e39..a0398ebd1c50b1be2433c109af6bb0d263c54ea5:/services/fuse/tests/test_unmount.py

diff --git a/services/fuse/tests/test_unmount.py b/services/fuse/tests/test_unmount.py
index 1b0fac0d32..e89571087e 100644
--- a/services/fuse/tests/test_unmount.py
+++ b/services/fuse/tests/test_unmount.py
@@ -2,11 +2,17 @@
 #
 # SPDX-License-Identifier: AGPL-3.0
 
+from __future__ import absolute_import
+from builtins import bytes
+import arvados_fuse.unmount
 import os
 import subprocess
+import shutil
+import tempfile
 import time
+import unittest
 
-from integration_test import IntegrationTest
+from .integration_test import IntegrationTest
 
 class UnmountTest(IntegrationTest):
     def setUp(self):
@@ -33,12 +39,13 @@ class UnmountTest(IntegrationTest):
              self.mnt,
              '--exec', 'true'])
         for m in subprocess.check_output(['mount']).splitlines():
-            self.assertNotIn(' '+self.mnt+' ', m)
+            expected = bytes(' ' + self.mnt + ' ', encoding='utf-8')
+            self.assertNotIn(expected, m)
 
     def _mounted(self, mounts):
         all_mounts = subprocess.check_output(['mount'])
         return [m for m in mounts
-                if ' '+m+' ' in all_mounts]
+                if bytes(' ' + m + ' ', encoding='utf-8') in all_mounts]
 
     def _wait_for_mounts(self, mounts):
         deadline = time.time() + 10
@@ -89,3 +96,45 @@ class UnmountTest(IntegrationTest):
         self.assertEqual(mounts, self._mounted(mounts))
         subprocess.check_call(['./bin/arv-mount', '--unmount-all', self.tmp])
         self.assertEqual([], self._mounted(mounts))
+
+
+
+class SaferRealpath(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp)
+
+    def test_safer_realpath(self):
+        os.mkdir(self.tmp+"/dir")
+        os.mkdir(self.tmp+"/dir/dir2")
+        os.symlink("missing", self.tmp+"/relative-missing")
+        os.symlink("dir", self.tmp+"/./relative-dir")
+        os.symlink("relative-dir", self.tmp+"/relative-indirect")
+        os.symlink(self.tmp+"/dir", self.tmp+"/absolute-dir")
+        os.symlink("./dir/../loop", self.tmp+"/loop")
+        os.symlink(".", self.tmp+"/dir/self")
+        os.symlink("..", self.tmp+"/dir/dir2/parent")
+        os.symlink("../dir3", self.tmp+"/dir/dir2/sibling")
+        os.symlink("../missing/../danger", self.tmp+"/dir/tricky")
+        os.symlink("/proc/1/fd/12345", self.tmp+"/eperm")
+        for (inpath, outpath, ok) in [
+                ("dir/self", "dir", True),
+                ("dir/dir2/parent", "dir", True),
+                ("dir/dir2/sibling", "dir/dir3", False),
+                ("dir", "dir", True),
+                ("relative-dir", "dir", True),
+                ("relative-missing", "missing", False),
+                ("relative-indirect", "dir", True),
+                ("absolute-dir", "dir", True),
+                ("loop", "loop", False),
+                # "missing" doesn't exist, so "missing/.." isn't our
+                # tmpdir; it's important not to contract this to just
+                # "danger".
+                ("dir/tricky", "missing/../danger", False),
+                ("eperm", "/proc/1/fd/12345", False),
+        ]:
+            if not outpath.startswith('/'):
+                outpath = self.tmp + '/' + outpath
+            self.assertEqual((outpath, ok), arvados_fuse.unmount.safer_realpath(self.tmp+"/"+inpath))