50 lines
1.8 KiB
Rust
50 lines
1.8 KiB
Rust
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
use molotov_bootstrap::apk::ApkExtractor;
|
|
use molotov_bootstrap::fflags::{FastFlagManager, FlagValue};
|
|
use std::fs::File;
|
|
use std::io::Write;
|
|
use tempfile::tempdir;
|
|
use zip::write::SimpleFileOptions;
|
|
use zip::ZipWriter;
|
|
|
|
#[test]
|
|
fn test_zipslip_traversal_is_prevented() {
|
|
let temp = tempdir().unwrap();
|
|
let zip_path = temp.path().join("malicious.apk");
|
|
|
|
// Create a zip with a traversal entry
|
|
let file = File::create(&zip_path).unwrap();
|
|
let mut zip = ZipWriter::new(file);
|
|
|
|
let options = SimpleFileOptions::default();
|
|
zip.start_file("assets/../../traversal.txt", options).unwrap();
|
|
zip.write_all(b"EVIL_PAYLOAD").unwrap();
|
|
zip.finish().unwrap();
|
|
|
|
let dest = temp.path().join("extracted");
|
|
let extractor = ApkExtractor::new(&zip_path);
|
|
|
|
// Extraction should safely ignore or reject traversal without writing outside dest
|
|
let _ = extractor.extract_target_binaries(&dest);
|
|
|
|
let escaped_file = temp.path().join("traversal.txt");
|
|
assert!(!escaped_file.exists(), "ZipSlip path traversal file must not be created outside destination");
|
|
}
|
|
|
|
#[test]
|
|
fn test_fastflag_type_coercion_and_sanitization() {
|
|
let mut manager = FastFlagManager::new();
|
|
// String "true" for boolean flag should coerce to Boolean(true)
|
|
manager.set_flag_coerced("FFlagDebugGraphicsDisableDirect3D11", "true");
|
|
assert_eq!(
|
|
manager.active_profile().flags.get("FFlagDebugGraphicsDisableDirect3D11"),
|
|
Some(&FlagValue::Boolean(true))
|
|
);
|
|
|
|
// Numeric string for integer flag should coerce to Integer(120)
|
|
manager.set_flag_coerced("DFIntTaskSchedulerTargetFps", "120");
|
|
assert_eq!(
|
|
manager.active_profile().flags.get("DFIntTaskSchedulerTargetFps"),
|
|
Some(&FlagValue::Integer(120))
|
|
);
|
|
}
|