已合并
check cross path access #1469
yring_8创建于 4月8日
check cross path access #1469
已合并
从已删除 :9.0.0合入到cann/runtime9.0.0
共 2 个文件变更+78-0
| @@ -63,6 +63,8 @@ static CommHandle AdxHdcConnect(CommHandle &client, uint16_t devId, | |||
| 63 | static int32_t AdxCommonGetFile(const CommHandle &handle, const std::string &srcFile) | 63 | static int32_t AdxCommonGetFile(const CommHandle &handle, const std::string &srcFile) |
| 64 | { | 64 | { |
| 65 | IDE_CTRL_VALUE_FAILED(!srcFile.empty(), return IDE_DAEMON_ERROR, "source file input invalid"); | 65 | IDE_CTRL_VALUE_FAILED(!srcFile.empty(), return IDE_DAEMON_ERROR, "source file input invalid"); |
| 66 | IDE_CTRL_VALUE_FAILED(FileUtils::CheckNonCrossPath(srcFile), return IDE_DAEMON_ERROR, | ||
| 67 | "Cross-path access may exist on the path: %s", srcFile.c_str()); | ||
| 66 | // create dir if not exist | 68 | // create dir if not exist |
| 67 | std::string saveDirName = FileUtils::GetFileDir(srcFile); | 69 | std::string saveDirName = FileUtils::GetFileDir(srcFile); |
| 68 | if (!FileUtils::IsFileExist(saveDirName)) { | 70 | if (!FileUtils::IsFileExist(saveDirName)) { |
| @@ -223,6 +225,8 @@ int32_t AdxGetDeviceFile(uint16_t devId, IdeString desPath, IdeString logType) | |||
| 223 | */ | 225 | */ |
| 224 | static int32_t AdxCreateFileAndRecvValue(const CommHandle &handle, std::string &file) | 226 | static int32_t AdxCreateFileAndRecvValue(const CommHandle &handle, std::string &file) |
| 225 | { | 227 | { |
| 228 | IDE_CTRL_VALUE_FAILED(FileUtils::CheckNonCrossPath(file), return IDE_DAEMON_ERROR, | ||
| 229 | "Cross-path access may exist on the path: %s", file.c_str()); | ||
| 226 | // create dir if not exist | 230 | // create dir if not exist |
| 227 | std::string saveDirName = FileUtils::GetFileDir(file); | 231 | std::string saveDirName = FileUtils::GetFileDir(file); |
| 228 | if (!FileUtils::IsFileExist(saveDirName)) { | 232 | if (!FileUtils::IsFileExist(saveDirName)) { |
| @@ -330,6 +330,63 @@ TEST_F(ADX_API_UTEST, AdxGetDeviceFileTimeout) | |||
| 330 | EXPECT_EQ(IDE_DAEMON_OK, AdxGetDeviceFile(0x1, "PATH1", "PATH2")); | 330 | EXPECT_EQ(IDE_DAEMON_OK, AdxGetDeviceFile(0x1, "PATH1", "PATH2")); |
| 331 | } | 331 | } |
| 332 | 332 | ||
| 333 | int g_GetStringMsgDataFilePathStub = 0; | ||
| 334 | static MsgCode GetStringMsgDataFilePathStub(const CommHandle &handle, std::string &value) | ||
| 335 | { | ||
| 336 | if(g_GetStringMsgDataFilePathStub == 0) { | ||
| 337 | value = "device/file"; | ||
| 338 | g_GetStringMsgDataFilePathStub = 4; | ||
| 339 | } else if (g_GetStringMsgDataFilePathStub == 1) { | ||
| 340 | value = "../device/file"; | ||
| 341 | g_GetStringMsgDataFilePathStub = 4; | ||
| 342 | } else if (g_GetStringMsgDataFilePathStub == 2) { | ||
| 343 | value = "device/../file"; | ||
| 344 | g_GetStringMsgDataFilePathStub = 4; | ||
| 345 | } else if (g_GetStringMsgDataFilePathStub == 3) { | ||
| 346 | value = "device/.."; | ||
| 347 | g_GetStringMsgDataFilePathStub = 4; | ||
| 348 | } else if (g_GetStringMsgDataFilePathStub == 4) { | ||
| 349 | value = "game_over"; | ||
| 350 | } | ||
| 351 | return IDE_DAEMON_NONE_ERROR; | ||
| 352 | } | ||
| 353 | |||
| 354 | TEST_F(ADX_API_UTEST, AdxGetDeviceFile_CheckCrossPathFailed) | ||
| 355 | { | ||
| 356 | CommHandle handle = ADX_COMMOPT_INVALID_HANDLE(OptType::COMM_HDC); | ||
| 357 | handle.type = OptType::COMM_HDC; | ||
| 358 | handle.session = 0x123456789; | ||
| 359 | |||
| 360 | MOCKER(AdxGetLogIdByPhyId).stubs().will(returnValue(IDE_DAEMON_OK)); | ||
| 361 | MOCKER(AdxMsgProto::SendMsgData).stubs().will(returnValue(IDE_DAEMON_NONE_ERROR)); | ||
| 362 | MOCKER(AdxMsgProto::GetStringMsgData).stubs().will(invoke(GetStringMsgDataFilePathStub)); | ||
| 363 | |||
| 364 | g_GetStringMsgDataFilePathStub = 0; | ||
| 365 | int32_t ret = AdxGetDeviceFile(0x1, "../basePath", "LogType"); | ||
| 366 | EXPECT_EQ(ret, IDE_DAEMON_OK); | ||
| 367 | |||
| 368 | g_GetStringMsgDataFilePathStub = 0; | ||
| 369 | ret = AdxGetDeviceFile(0x1, "./../basePath", "LogType"); | ||
| 370 | EXPECT_EQ(ret, IDE_DAEMON_OK); | ||
| 371 | |||
| 372 | g_GetStringMsgDataFilePathStub = 0; | ||
| 373 | ret = AdxGetDeviceFile(0x1, "basePath/..", "LogType"); | ||
| 374 | EXPECT_EQ(ret, IDE_DAEMON_OK); | ||
| 375 | |||
| 376 | g_GetStringMsgDataFilePathStub = 1; | ||
| 377 | ret = AdxGetDeviceFile(0x1, "basePath", "LogType"); | ||
| 378 | EXPECT_EQ(ret, IDE_DAEMON_OK); | ||
| 379 | |||
| 380 | g_GetStringMsgDataFilePathStub = 2; | ||
| 381 | ret = AdxGetDeviceFile(0x1, "basePath", "LogType"); | ||
| 382 | EXPECT_EQ(ret, IDE_DAEMON_OK); | ||
| 383 | |||
| 384 | g_GetStringMsgDataFilePathStub = 3; | ||
| 385 | ret = AdxGetDeviceFile(0x1, "basePath", "LogType"); | ||
| 386 | EXPECT_EQ(ret, IDE_DAEMON_OK); | ||
| 387 | } | ||
| 388 | |||
| 389 | |||
| 333 | TEST_F(ADX_API_UTEST, AdxGetDeviceFileGetFileFailed) | 390 | TEST_F(ADX_API_UTEST, AdxGetDeviceFileGetFileFailed) |
| 334 | { | 391 | { |
| 335 | CommHandle handle = ADX_COMMOPT_INVALID_HANDLE(OptType::COMM_HDC); | 392 | CommHandle handle = ADX_COMMOPT_INVALID_HANDLE(OptType::COMM_HDC); |
| @@ -813,4 +870,21 @@ TEST_F(ADX_API_UTEST, AdxRecvDevFileTimeoutSucc) | |||
| 813 | .will(invoke(HdcReadTimeoutDataStub)); | 870 | .will(invoke(HdcReadTimeoutDataStub)); |
| 814 | EXPECT_EQ(IDE_DAEMON_OK, AdxRecvDevFileTimeout(handle, desPath, 1000, filename, 1024)); | 871 | EXPECT_EQ(IDE_DAEMON_OK, AdxRecvDevFileTimeout(handle, desPath, 1000, filename, 1024)); |
| 815 | free(handle); | 872 | free(handle); |
| 873 | } | ||
| 874 | |||
| 875 | TEST_F(ADX_API_UTEST, AdxRecvDevFileTimeout_CheckCrossPathFailed) | ||
| 876 | { | ||
| 877 | AdxCommHandle handle = (AdxCommHandle)IdeXmalloc(sizeof(CommHandle)); | ||
| 878 | const char *desPath = "/tmp/adcore_utest"; | ||
| 879 | char filename[1024] = {0}; | ||
| 880 | char *value = "../test"; | ||
| 881 | MOCKER(AdxRecvMsg) | ||
| 882 | .stubs() | ||
| 883 | .with(any(), outBoundP(&value, sizeof(value)), any(), any()) | ||
| 884 | .will(returnValue(IDE_DAEMON_OK)); | ||
| 885 | MOCKER(HdcReadTimeout) | ||
| 886 | .stubs() | ||
| 887 | .will(invoke(HdcReadTimeoutDataStub)); | ||
| 888 | EXPECT_EQ(IDE_DAEMON_ERROR, AdxRecvDevFileTimeout(handle, desPath, 1000, filename, 1024)); | ||
| 889 | free(handle); | ||
| 816 | } | 890 | } |