github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 22:58:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(test): snapshot tar.bz2 skills install env

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-21 18:39:12 +00:00
parent b44aa5b1f7
commit ae06dbb794
1 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/agents/skills-install.download-tarbz2.e2e.test.ts
View File

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
import os from "node:os"; import os from "node:os";
import path from "node:path"; import path from "node:path";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { captureEnv } from "../test-utils/env.js";
import { setTempStateDir, writeDownloadSkill } from "./skills-install.download-test-utils.js"; import { setTempStateDir, writeDownloadSkill } from "./skills-install.download-test-utils.js";
import { installSkill } from "./skills-install.js"; import { installSkill } from "./skills-install.js";
@@ -10,6 +11,7 @@ const mocks = {
scanSummary: vi.fn(), scanSummary: vi.fn(),
fetchGuard: vi.fn(), fetchGuard: vi.fn(),
}; };
let envSnapshot: ReturnType<typeof captureEnv>;
function mockDownloadResponse() { function mockDownloadResponse() {
mocks.fetchGuard.mockResolvedValue({ mocks.fetchGuard.mockResolvedValue({
@@ -85,20 +87,6 @@ async function writeTarBz2Skill(params: {
}); });
} }
function restoreOpenClawStateDir(originalValue: string | undefined): void {
if (originalValue === undefined) {
delete process.env.OPENCLAW_STATE_DIR;
return;
}
process.env.OPENCLAW_STATE_DIR = originalValue;
}
const originalStateDir = process.env.OPENCLAW_STATE_DIR;
afterEach(() => {
restoreOpenClawStateDir(originalStateDir);
});
vi.mock("../process/exec.js", () => ({ vi.mock("../process/exec.js", () => ({
runCommandWithTimeout: (...args: unknown[]) => mocks.runCommand(...args), runCommandWithTimeout: (...args: unknown[]) => mocks.runCommand(...args),
})); }));
@@ -117,6 +105,7 @@ vi.mock("../security/skill-scanner.js", async (importOriginal) => {
describe("installSkill download extraction safety (tar.bz2)", () => { describe("installSkill download extraction safety (tar.bz2)", () => {
beforeEach(() => { beforeEach(() => {
envSnapshot = captureEnv(["OPENCLAW_STATE_DIR"]);
mocks.runCommand.mockReset(); mocks.runCommand.mockReset();
mocks.scanSummary.mockReset(); mocks.scanSummary.mockReset();
mocks.fetchGuard.mockReset(); mocks.fetchGuard.mockReset();
@@ -129,6 +118,10 @@ describe("installSkill download extraction safety (tar.bz2)", () => {
}); });
}); });
afterEach(() => {
envSnapshot.restore();
});
it("rejects tar.bz2 traversal before extraction", async () => { it("rejects tar.bz2 traversal before extraction", async () => {
await withTempWorkspace(async ({ workspaceDir, stateDir }) => { await withTempWorkspace(async ({ workspaceDir, stateDir }) => {
const url = "https://example.invalid/evil.tbz2"; const url = "https://example.invalid/evil.tbz2";