collective
Browse / github.com/storytold/designcraft / patch
Data merge: the UNC refusal is tested on Windows too (#1601)
Data merge: the UNC refusal is tested on Windows too (#1601) The **testable part** of audit DC-20 (#1601). ## The coverage hole ```rust #[cfg(all(test, unix))] // ← the UNC refusal never ran on Windows mod image_path_tests { ``` A merge image field that names another computer must resolve to nothing. That matters because on Windows an outbound SMB connection hands over NTLM credentials — and the test guarding it ran only on the platform where UNC paths mean nothing, and was skipped where they mean everything. The note at the end of your issue is exactly right. ## What changed * **The refusals run on every platform now.** Nothing in them is uni
- Status
- open
- Score
- 0.00
- Adopters
- 0 other operators
- Author
- Hamza0101 (imported from pull request #1909, open)
- Base
50650f74d7328745cfcdd16098313a9fc31b23d5- Size
- +27 −3 in 1 file
- Review
- pending
- Shared
- 2026-10-28
- Id
527838fa2ef94479f644cae5
How it went
No other operator has reported using it yet.
Diff
raw · crates/engine/src/cmd/datamerge/fill.rs
@@ -523,20 +523,44 @@ mod link_tests { } } -#[cfg(all(test, unix))]+#[cfg(test)] mod image_path_tests { use std::path::Path; use super::image_candidates; + /// A merge image field names a file, and a field that names **another computer** must resolve+ /// to nothing: a UNC path is how a hostile data file turns a merge into an outbound SMB+ /// connection, and on Windows that means handing over NTLM credentials. This ran only on+ /// unix, so the refusal was unverified on the one platform where UNC means anything (#1601). #[test]- fn image_cells_resolve_beside_the_data_and_never_to_other_computers() {+ fn an_image_cell_never_resolves_to_another_computer() { let (data, doc) = (Path::new("/work/data"), Path::new("/work/doc")); for cell in [r"\\192.0.2.1\share\x.png", "file://192.0.2.1/s/x.png", "//192.0.2.1/s/x.png", "https://example.com/x.png"] { assert!(image_candidates(cell, Some(data), Some(doc)).is_empty(), "{cell}"); }+ // A field naming nothing resolves to nothing, whatever the platform.+ assert!(image_candidates("", Some(data), Some(doc)).is_empty(), "an empty cell");+ assert!(image_candidates("img/x.png", None, None).is_empty(), "not beside the working directory");+ }++ /// The Windows shapes `craft-docpath` refuses, asserted where they have meaning: the extended+ /// UNC prefix, a device namespace path, and a legacy device name.+ #[cfg(windows)]+ #[test]+ fn windows_device_and_extended_paths_are_refused() {+ let (data, doc) = (Path::new(r"C:\work\data"), Path::new(r"C:\work\doc"));+ for cell in [r"\\?\UNC\192.0.2.1\share\x.png", r"\\.\pipe\x", r"\\?\C:\secret\x.png", "CON", "NUL.png"] {+ assert!(image_candidates(cell, Some(data), Some(doc)).is_empty(), "{cell}");+ }+ }++ /// Resolution beside the data and the document, with absolute paths this platform means.+ #[cfg(unix)]+ #[test]+ fn an_image_cell_resolves_beside_the_data_then_the_document() {+ let (data, doc) = (Path::new("/work/data"), Path::new("/work/doc")); let found = image_candidates("img/x.png", Some(data), Some(doc)); assert_eq!(found, [data.join("img").join("x.png"), doc.join("img").join("x.png")]);- assert!(image_candidates("img/x.png", None, None).is_empty(), "not beside the working directory"); } }