mirror of
https://github.com/GoodOlClint/PSProxmoxVE.git
synced 2026-09-04 03:05:32 +00:00
goodolclint-claude[bot]
1bf7483a4e
* fix: escape dynamic path segments in three Remove-* cmdlets Wrap Storage, Vnet, and Zone parameters with Uri.EscapeDataString() in RemovePveStorageCmdlet, RemovePveSdnVnetCmdlet, and RemovePveSdnZoneCmdlet to prevent path traversal attacks via the API path. Add xUnit test demonstrating that escaped paths preserve percent-encoding (preventing path collapse) while unescaped paths allow segment traversal. Fixes #145 * fix: route Remove-Pve{Storage,SdnVnet,SdnZone} through their services Delete the private PveHttpClient construction and inline Uri.EscapeDataString call in RemovePveStorageCmdlet, RemovePveSdnVnetCmdlet and RemovePveSdnZoneCmdlet; call StorageService.RemoveStorage / NetworkService.RemoveSdnZone / NetworkService.RemoveSdnVnet instead, which already escape the identifier identically and are now the single place doing so. Add ValidatePattern on the Storage/Vnet/Zone parameters as defense in depth, anchored with \A/\z so a trailing newline cannot slip a disallowed character past the gate. Replace PveHttpClientPathEscapingTests with a version that actually regression-tests the real Uri parser (asserts both that %2F survives and that the unescaped form is absent), and add StorageServiceTests/NetworkServiceTests cases that mock IPveHttpClient and verify the exact escaped DELETE path for a traversal-attempt name. --------- Co-authored-by: goodolclint-claude[bot] <323206664+goodolclint-claude[bot]@users.noreply.github.com>
63 lines
2.1 KiB
C#
63 lines
2.1 KiB
C#
using Moq;
|
|
using Xunit;
|
|
using PSProxmoxVE.Core.Authentication;
|
|
using PSProxmoxVE.Core.Client;
|
|
using PSProxmoxVE.Core.Services;
|
|
|
|
namespace PSProxmoxVE.Core.Tests.Services
|
|
{
|
|
public class NetworkServiceTests
|
|
{
|
|
private readonly Mock<IPveHttpClient> _mockClient;
|
|
private readonly NetworkService _service;
|
|
private readonly PveSession _session;
|
|
|
|
public NetworkServiceTests()
|
|
{
|
|
_mockClient = new Mock<IPveHttpClient>();
|
|
_service = new NetworkService(_mockClient.Object);
|
|
_session = new PveSession(
|
|
"pve.example.com",
|
|
8006,
|
|
skipCertificateCheck: true,
|
|
apiToken: "root@pam!test=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
|
|
}
|
|
|
|
// -----------------------------------------------------------------
|
|
// RemoveSdnZone
|
|
// -----------------------------------------------------------------
|
|
|
|
[Fact]
|
|
public void RemoveSdnZone_EscapesPathTraversalInName()
|
|
{
|
|
// Arrange
|
|
_mockClient.Setup(c => c.DeleteAsync("cluster/sdn/zones/..%2Faccess%2Fusers%2Fx"))
|
|
.ReturnsAsync(@"{""data"":null}");
|
|
|
|
// Act
|
|
_service.RemoveSdnZone(_session, "../access/users/x");
|
|
|
|
// Assert
|
|
_mockClient.Verify(c => c.DeleteAsync("cluster/sdn/zones/..%2Faccess%2Fusers%2Fx"), Times.Once);
|
|
}
|
|
|
|
// -----------------------------------------------------------------
|
|
// RemoveSdnVnet
|
|
// -----------------------------------------------------------------
|
|
|
|
[Fact]
|
|
public void RemoveSdnVnet_EscapesPathTraversalInName()
|
|
{
|
|
// Arrange
|
|
_mockClient.Setup(c => c.DeleteAsync("cluster/sdn/vnets/..%2Faccess%2Fusers%2Fx"))
|
|
.ReturnsAsync(@"{""data"":null}");
|
|
|
|
// Act
|
|
_service.RemoveSdnVnet(_session, "../access/users/x");
|
|
|
|
// Assert
|
|
_mockClient.Verify(c => c.DeleteAsync("cluster/sdn/vnets/..%2Faccess%2Fusers%2Fx"), Times.Once);
|
|
}
|
|
}
|
|
}
|