pcloudcc-lneely/tests/unit-tests
Levi Neely 0430d0b872
Fix pcl-aex: validate PCLOUD_LOG_PATH to prevent arbitrary file write and log injection (#357)
* Fix pcl-aex.1: validate PCLOUD_LOG_PATH before use in psync_debug_path()

Add pdbg_path_is_safe() helper that rejects PCLOUD_LOG_PATH values
that are not absolute, contain '..' path components, or do not resolve
under the user HOME directory or /tmp. On rejection, fall back to the
default ~/.pcloud/debug.log path and emit a warning to stderr.

Also fix a pre-existing memory leak: ppath_home() return was not freed
in the default-path branch.

Ref GH #291.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add PCLOUD_LOG_PATH path-safety tests (pcl-aex)

28 test cases covering relative paths, '..' traversal, paths outside
HOME and /tmp, valid accepted paths, and psync_debug_path() env
fallback behaviour.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Levi Neely <lkn@darkstar.example.net>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-07 18:53:17 +01:00
..
test_pdbg_path.c Fix pcl-aex: validate PCLOUD_LOG_PATH to prevent arbitrary file write and log injection (#357) 2026-03-07 18:53:17 +01:00
test_pfs_lock_ordering.c Fix pcl-zqv.5.7: eliminate deadlock in pfs_get_both_locks (#339) 2026-03-03 19:33:56 +01:00
test_prun.c Fix pcl-aqb: pthread_create unchecked return, thread_data leak, and function-pointer cast UB in prun.c (#356) 2026-03-07 18:44:47 +01:00
test_ptools_params.c Fix pcl-a1j: buffer overflow in ptools_create_backend_event() via unchecked sprintf and strcat (#355) 2026-03-07 18:35:43 +01:00
test_read_response.cpp Fix pcl-6nb: readResponse buffer over-read via unchecked msg->length (#354) 2026-03-07 18:08:56 +01:00