pcloudcc-lneely/tests
Levi Neely 0430d0b872
Fix pcl-aex: validate PCLOUD_LOG_PATH to prevent arbitrary file write and log injection (#357)
* Fix pcl-aex.1: validate PCLOUD_LOG_PATH before use in psync_debug_path()

Add pdbg_path_is_safe() helper that rejects PCLOUD_LOG_PATH values
that are not absolute, contain '..' path components, or do not resolve
under the user HOME directory or /tmp. On rejection, fall back to the
default ~/.pcloud/debug.log path and emit a warning to stderr.

Also fix a pre-existing memory leak: ppath_home() return was not freed
in the default-path branch.

Ref GH #291.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add PCLOUD_LOG_PATH path-safety tests (pcl-aex)

28 test cases covering relative paths, '..' traversal, paths outside
HOME and /tmp, valid accepted paths, and psync_debug_path() env
fallback behaviour.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Levi Neely <lkn@darkstar.example.net>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-07 18:53:17 +01:00
..
fault-inject Fix pcl-zqv.5.7: eliminate deadlock in pfs_get_both_locks (#339) 2026-03-03 19:33:56 +01:00
smoke-tests Fix pcl-zqv.5.7: eliminate deadlock in pfs_get_both_locks (#339) 2026-03-03 19:33:56 +01:00
unit-tests Fix pcl-aex: validate PCLOUD_LOG_PATH to prevent arbitrary file write and log injection (#357) 2026-03-07 18:53:17 +01:00