Fix review findings: hostile snapshots, stale async results, trash safety

- snapshot: depth limit (stack overflow in exporters), decompressed-size limit (gzip bombs), per-node size cap and saturating aggregation - export: sanitise exclusion patterns from snapshot metadata - tui: drop duplicate/trash/filter results that belong to a replaced tree; cancel duplicate search on rescan - trash: refuse symlinked or foreign shared-filesystem trash dirs; never overwrite an existing trashed item - scan: no symlink following without inode identity; correct unscanned count and keep real read errors after cancellation
2026-10-02 08:46:52 +01:00
parent 11a0e401ee
commit f4ef12a0dd
10 changed files with 315 additions and 44 deletions
@@ -0,0 +1,131 @@
+package snapshot
+
+import (
+	"bytes"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/binary"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/andydixon/mapsize/internal/brand"
+	"github.com/andydixon/mapsize/internal/export"
+	"github.com/andydixon/mapsize/internal/inventory"
+)
+
+// craft builds a well-formed (correctly checksummed) but hostile snapshot.
+func craft(n int, meta string, rec func(i int, w *writer)) []byte {
+	var out bytes.Buffer
+	out.WriteString(brand.SnapshotMagic)
+	out.Write(binary.LittleEndian.AppendUint16(nil, Version))
+	out.Write(binary.LittleEndian.AppendUint16(nil, flagGzipped))
+	gz, _ := gzip.NewWriterLevel(&out, gzip.BestCompression)
+	h := sha256.New()
+	w := &writer{w: io.MultiWriter(gz, h)}
+	w.uvarint(uint64(len(meta)))
+	w.bytes([]byte(meta))
+	w.uvarint(1)
+	w.str("")
+	w.uvarint(uint64(n))
+	for i := range n {
+		rec(i, w)
+	}
+	w.uvarint(0)
+	gz.Close()
+	out.Write(h.Sum(nil))
+	return out.Bytes()
+}
+
+func node(w *writer, pd uint64, kind inventory.Kind, name string, size int64) {
+	w.uvarint(pd)
+	w.bytes([]byte{byte(kind), 0})
+	w.uvarint(0)
+	w.str(name)
+	w.varint(size)
+	w.varint(size)
+	w.varint(0)
+	for range 5 {
+		w.uvarint(0)
+	}
+}
+
+func chain(n int) []byte {
+	return craft(n, `{"root":"/r"}`, func(i int, w *writer) {
+		if i == 0 {
+			node(w, 0, inventory.KindDir, "", 0)
+		} else {
+			node(w, 1, inventory.KindDir, "a", 0)
+		}
+	})
+}
+
+func TestDeepChainRejected(t *testing.T) {
+	if _, err := Load(bytes.NewReader(chain(MaxDepth + 1))); err != nil {
+		t.Fatalf("depth at the limit must load: %v", err)
+	}
+	_, err := Load(bytes.NewReader(chain(MaxDepth + 2)))
+	if err == nil || !strings.Contains(err.Error(), "deeper") {
+		t.Fatalf("over-deep chain accepted: %v", err)
+	}
+}
+
+func TestDecompressionBombLimited(t *testing.T) {
+	flat := craft(100_000, `{"root":"/r"}`, func(i int, w *writer) {
+		if i == 0 {
+			node(w, 0, inventory.KindDir, "", 0)
+		} else {
+			node(w, uint64(i), inventory.KindFile, "f", 0)
+		}
+	})
+	_, err := LoadLimit(bytes.NewReader(flat), 64<<10)
+	if err == nil || !strings.Contains(err.Error(), "limit") {
+		t.Fatalf("bomb not limited: %v", err)
+	}
+	if got := bodyLimit(int64(len(flat))); got < 64<<20 {
+		t.Fatalf("bodyLimit floor: %d", got)
+	}
+}
+
+func TestHugeSizesDoNotWrap(t *testing.T) {
+	data := craft(3, `{"root":"/r"}`, func(i int, w *writer) {
+		if i == 0 {
+			node(w, 0, inventory.KindDir, "", 0)
+		} else {
+			node(w, uint64(i), inventory.KindFile, "f", MaxSize)
+		}
+	})
+	tr, err := Load(bytes.NewReader(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if tr.Node(0).TotSize < 0 {
+		t.Fatal("aggregate wrapped negative")
+	}
+	over := craft(2, `{"root":"/r"}`, func(i int, w *writer) {
+		if i == 0 {
+			node(w, 0, inventory.KindDir, "", 0)
+		} else {
+			node(w, 1, inventory.KindFile, "f", MaxSize+1)
+		}
+	})
+	if _, err := Load(bytes.NewReader(over)); err == nil {
+		t.Fatal("size above MaxSize accepted")
+	}
+}
+
+func TestHostileMetadataSanitisedInSummary(t *testing.T) {
+	data := craft(1, `{"root":"/r\u001b[2J","excludes":["\u001b]0;PWNED\u0007"],"excluded":1}`, func(i int, w *writer) {
+		node(w, 0, inventory.KindDir, "", 0)
+	})
+	tr, err := Load(bytes.NewReader(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	tr.Stats.Excluded = 1
+	var b bytes.Buffer
+	export.Summary(&b, tr)
+	if strings.ContainsAny(b.String(), "\x1b\x07") {
+		t.Fatalf("raw control characters in summary: %q", b.String())
+	}
+}