test: cover archive symlink and auth redaction shapes

Author: willronchetti

test/test_ff_utils.py

@@ -370,6 +370,18 @@ def test_unified_authenticator_authentication_error_redacts_auth_in_message():
             assert exc.auth == bad_auth
 
 
+@pytest.mark.parametrize("auth, secrets", [
+    (("key-value", "secret-value"), ("key-value", "secret-value")),
+    (["key-value", "secret-value"], ("key-value", "secret-value")),
+    ("opaque-credential", ("opaque-credential",)),
+])
+def test_unified_authenticator_authentication_error_redacts_other_auth_shapes(auth, secrets):
+    exc = ff_utils.UnifiedAuthenticator.AuthenticationError("Invalid authentication.", auth, "test-env")
+
+    assert all(secret not in str(exc) for secret in secrets)
+    assert exc.auth == auth
+
+
 # Integration tests
 
 @pytest.mark.integratedx

test/test_zip_utils.py

@@ -23,6 +23,14 @@ def _make_tar_with_member(tar_path: str, member_name: str, content: bytes = b"da
         tf.addfile(info, io.BytesIO(content))
 
 
+def _make_tar_with_symlink(tar_path: str, member_name: str, link_target: str) -> None:
+    with tarfile.open(tar_path, "w") as tf:
+        info = tarfile.TarInfo(name=member_name)
+        info.type = tarfile.SYMTYPE
+        info.linkname = link_target
+        tf.addfile(info)
+
+
 def test_unpack_zip_file_to_temporary_directory_rejects_path_traversal():
     # Zip Slip: a malicious archive entry named with ../ segments must not be extracted
     # outside of the target directory, even though zipfile.extractall would otherwise allow it.
@@ -69,6 +77,15 @@ def test_unpack_tar_file_to_temporary_directory_rejects_path_traversal():
         assert not os.path.exists("/tmp/dcicutils_tar_slip_poc.txt")
 
 
+def test_unpack_tar_file_to_temporary_directory_rejects_escaping_symlink():
+    with temporary_directory() as work_dir:
+        tar_path = os.path.join(work_dir, "evil_symlink.tar")
+        _make_tar_with_symlink(tar_path, "escape", "../../../tmp")
+        with pytest.raises(tarfile.FilterError):
+            with unpack_tar_file_to_temporary_directory(tar_path):
+                pass
+
+
 def test_unpack_tar_file_to_temporary_directory_extracts_benign_archive():
     with temporary_directory() as work_dir:
         tar_path = os.path.join(work_dir, "benign.tar")