46 lines
2.1 KiB
Go
46 lines
2.1 KiB
Go
package agentwire
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestDeploymentPlanDigestRejectsPrivilegedFieldSubstitution(t *testing.T) {
|
|
plan := DeploymentPlan{
|
|
SchemaVersion: DeploymentPlanVersion, InstanceID: "abcdefghijklmnopqrstuvwx", TemplateID: "palworld-official", TemplateVersion: "1.0.0",
|
|
TemplateDigest: strings.Repeat("a", 64), Image: "example.invalid/game:1",
|
|
Ports: []PlanPort{{ID: "game", Protocol: "udp", ContainerPort: 8211, HostPort: 38211, Publish: true}},
|
|
Mounts: []PlanMount{{ID: "saved", HostPath: filepath.Join(string(filepath.Separator), "srv", "games", "saved"), ContainerPath: "/game/saved"}},
|
|
Resources: PlanResource{CPUCores: 2, MemoryMB: 1024, StorageGB: 10}, StopTimeoutSeconds: 30,
|
|
}
|
|
digest, err := plan.CanonicalDigest()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
plan.PlanDigest = digest
|
|
if err := plan.Validate(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
plan.Image = "attacker.invalid/game:latest"
|
|
if err := plan.Validate(); err == nil {
|
|
t.Fatal("image substitution preserved a valid binding")
|
|
}
|
|
}
|
|
|
|
func TestDeploymentPlanRejectsReservedLabelsAndInvalidUser(t *testing.T) {
|
|
plan := DeploymentPlan{SchemaVersion: DeploymentPlanVersion, InstanceID: "abcdefghijklmnopqrstuvwx", TemplateID: "palworld-official", TemplateVersion: "1.0.0", TemplateDigest: strings.Repeat("a", 64), Image: "example.invalid/game:1", Ports: []PlanPort{{ID: "game", Protocol: "udp", ContainerPort: 8211, HostPort: 38211, Publish: true}}, Mounts: []PlanMount{{ID: "saved", HostPath: filepath.Join(string(filepath.Separator), "srv", "games", "saved"), ContainerPath: "/game/saved"}}, Resources: PlanResource{CPUCores: 2, MemoryMB: 1024, StorageGB: 10}, StopTimeoutSeconds: 30, Labels: map[string]string{"dogama.managed": "false"}, User: "1000:1000"}
|
|
digest, _ := plan.CanonicalDigest()
|
|
plan.PlanDigest = digest
|
|
if err := plan.Validate(); err == nil {
|
|
t.Fatal("reserved label accepted")
|
|
}
|
|
plan.Labels = map[string]string{"dashboard.name": "server"}
|
|
plan.User = "root"
|
|
digest, _ = plan.CanonicalDigest()
|
|
plan.PlanDigest = digest
|
|
if err := plan.Validate(); err == nil {
|
|
t.Fatal("non-numeric Docker user accepted")
|
|
}
|
|
}
|