93 lines
3.1 KiB
TypeScript
93 lines
3.1 KiB
TypeScript
import { readFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
import {
|
|
createDeterministicZip,
|
|
parseReleaseArguments,
|
|
safeArchivePath,
|
|
} from "./package-release.mjs";
|
|
import { sha256 } from "./checksum-release.mjs";
|
|
|
|
describe("release packaging", () => {
|
|
it("creates a deterministic archive independent of input order", () => {
|
|
const entries = [
|
|
{ name: "index.html", data: Buffer.from("<p>ok</p>") },
|
|
{ name: "assets/app.js", data: Buffer.from("export {};") },
|
|
];
|
|
expect(sha256(createDeterministicZip(entries))).toBe(
|
|
sha256(createDeterministicZip([...entries].reverse())),
|
|
);
|
|
});
|
|
|
|
it.each(["../secret", "/absolute", "C:/absolute", "a\\b", "a/./b", ""])(
|
|
"rejects unsafe path %j",
|
|
(candidate) => {
|
|
expect(() => safeArchivePath(candidate)).toThrow();
|
|
},
|
|
);
|
|
|
|
it("rejects duplicate paths, source maps and credential-like entries", () => {
|
|
expect(() =>
|
|
createDeterministicZip([
|
|
{ name: "index.html", data: Buffer.from("one") },
|
|
{ name: "index.html", data: Buffer.from("two") },
|
|
]),
|
|
).toThrow("Duplicate release path");
|
|
expect(() =>
|
|
createDeterministicZip([
|
|
{ name: "assets/app.js.map", data: Buffer.from("{}") },
|
|
]),
|
|
).toThrow("Source map");
|
|
expect(() =>
|
|
createDeterministicZip([{ name: ".env", data: Buffer.from("TOKEN=x") }]),
|
|
).toThrow("Credential-like");
|
|
});
|
|
|
|
it("scans reStructuredText legal notices for local build paths", () => {
|
|
expect(() =>
|
|
createDeterministicZip([
|
|
{
|
|
name: "engines/python/NOTICE.cpython-bundled.rst",
|
|
data: Buffer.from("Built from /home/example/private/source"),
|
|
},
|
|
]),
|
|
).toThrow("Local absolute path");
|
|
});
|
|
|
|
it.each([
|
|
["assets/leak.js", Buffer.from('const source = "/mnt/private/app.ts";')],
|
|
[
|
|
"engines/example/module.wasm",
|
|
Buffer.from("/home/private/build/runtime.c"),
|
|
],
|
|
[
|
|
"engines/example/module.pdb",
|
|
Buffer.from("c:\\Users\\private\\source\\module.cs", "utf16le"),
|
|
],
|
|
])("scans JS, WebAssembly and PDB-like asset %s", (name, data) => {
|
|
expect(() => createDeterministicZip([{ name, data }])).toThrow(
|
|
"Local absolute path",
|
|
);
|
|
});
|
|
|
|
it("allows only the byte-exact upstream Perl and Ruby path-bearing assets", async () => {
|
|
for (const name of ["engines/perl/emperl.data", "engines/ruby/ruby.wasm"]) {
|
|
const data = await readFile(path.resolve("public", name));
|
|
expect(() => createDeterministicZip([{ name, data }])).not.toThrow();
|
|
expect(() =>
|
|
createDeterministicZip([
|
|
{ name, data: Buffer.concat([data, Buffer.from("changed")]) },
|
|
]),
|
|
).toThrow("Local absolute path");
|
|
}
|
|
}, 30_000);
|
|
|
|
it("requires an explicit force flag for exact-version replacement", () => {
|
|
expect(parseReleaseArguments([])).toEqual({ force: false });
|
|
expect(parseReleaseArguments(["--force"])).toEqual({ force: true });
|
|
expect(() => parseReleaseArguments(["--unknown"])).toThrow(
|
|
"Unknown release argument",
|
|
);
|
|
});
|
|
});
|