b47ee11ba4
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NBHF4R9EAejDJUMdwr6C68
65 lines
1.6 KiB
Go
65 lines
1.6 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func writeFileMode(t *testing.T, dir, name string, mode os.FileMode, content string) string {
|
|
t.Helper()
|
|
p := filepath.Join(dir, name)
|
|
if err := os.WriteFile(p, []byte(content), mode); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.Chmod(p, mode); err != nil { // umask umgehen
|
|
t.Fatal(err)
|
|
}
|
|
return p
|
|
}
|
|
|
|
func TestCheckFileModeAcceptsTightPermissions(t *testing.T) {
|
|
dir := t.TempDir()
|
|
for _, mode := range []os.FileMode{0o600, 0o640, 0o400} {
|
|
p := writeFileMode(t, dir, "s.txt", mode, "x")
|
|
if err := CheckFileMode(p, 0o640); err != nil {
|
|
t.Errorf("mode %#o should be accepted: %v", mode, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCheckFileModeRejectsLoosePermissions(t *testing.T) {
|
|
dir := t.TempDir()
|
|
for _, mode := range []os.FileMode{0o644, 0o660, 0o604, 0o777} {
|
|
p := writeFileMode(t, dir, "s.txt", mode, "x")
|
|
err := CheckFileMode(p, 0o640)
|
|
if err == nil {
|
|
t.Errorf("mode %#o must be rejected", mode)
|
|
continue
|
|
}
|
|
if !strings.Contains(err.Error(), "chmod") {
|
|
t.Errorf("Fehler sollte den Reparaturbefehl nennen, got: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCheckDirModeRejectsWorldWritable(t *testing.T) {
|
|
dir := t.TempDir()
|
|
sub := filepath.Join(dir, "logs")
|
|
if err := os.Mkdir(sub, 0o777); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.Chmod(sub, 0o777); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := CheckDirMode(sub, 0o750); err == nil {
|
|
t.Fatal("0777-Verzeichnis muss abgelehnt werden")
|
|
}
|
|
if err := os.Chmod(sub, 0o750); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := CheckDirMode(sub, 0o750); err != nil {
|
|
t.Errorf("0750 sollte akzeptiert werden: %v", err)
|
|
}
|
|
}
|