admin/CLICD
1
0
Fork 0
mirror of https://github.com/MengMengCode/CLICD.git synced 2026-08-08 06:24:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复剩余 CodeQL 高危告警

Browse Source
This commit is contained in:
MengMengCode
2026-07-18 21:31:31 +08:00
parent 04cefe0cf1
commit 6bdeafccf2
3 changed files with 14 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/kvm/kvm_test.go
+8 -6
View File
@@ -3,6 +3,7 @@ package kvm
import (
"crypto/ed25519"
"crypto/rand"
"path/filepath"
"reflect"
"testing"
@@ -11,14 +12,15 @@ import (
"golang.org/x/crypto/ssh"
)
func TestLocalImageIDRejectsPathExpressions(t *testing.T) {
for _, id := range []string{"", ".", "..", "../../etc/passwd", `..\\..\\windows`, "/absolute"} {
if got := localImageID(id); got != "__invalid_image_id__" {
t.Fatalf("localImageID(%q) = %q", id, got)
func TestImagePathUsesAllowlistedImageID(t *testing.T) {
for _, id := range []string{"", ".", "..", "../../etc/passwd", `..\\..\\windows`, "/absolute", "unknown-image"} {
if got := filepath.Base(ImagePath(id)); got != "__invalid_image_id__.qcow2" {
t.Fatalf("ImagePath(%q) basename = %q", id, got)
}
}
if got := localImageID("debian-13-kvm"); got != "debian-13-kvm" {
t.Fatalf("localImageID(valid) = %q", got)
validID := GetImages()[0].ID
if got := filepath.Base(ImagePath(validID)); got != validID+".qcow2" {
t.Fatalf("ImagePath(%q) basename = %q", validID, got)
}
}