arf-console 0.7.0-beta.1

A cross-platform R console written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

//! Provider values and file contents must not leak into diagnostics.

use super::*;

#[test]
fn overlong_version_file_value_is_not_disclosed_in_diagnostic() {
    let temp = tempfile::tempdir().unwrap();
    let marker = "4".repeat(300);
    std::fs::write(temp.path().join("project.r-version"), &marker).unwrap();

    let diagnostics = fallback_diagnostic_text(
        &[RSourceOverride::VersionFile {
            file: "project.r-version".into(),
        }],
        temp.path(),
    );

    assert!(diagnostics.contains("exceeds 256 bytes"));
    assert!(!diagnostics.contains(&marker));
}

#[test]
fn later_version_file_lines_are_not_disclosed_in_diagnostic() {
    let temp = tempfile::tempdir().unwrap();
    let private_contents = "private trailing contents that must not be disclosed";
    std::fs::write(
        temp.path().join("project.r-version"),
        format!("not-a-version\n{private_contents}\n"),
    )
    .unwrap();

    let diagnostics = fallback_diagnostic_text(
        &[RSourceOverride::VersionFile {
            file: "project.r-version".into(),
        }],
        temp.path(),
    );

    assert!(!diagnostics.contains(private_contents));
}

#[test]
fn invalid_version_markers_are_not_disclosed_for_file_providers() {
    let marker = "SUPER-SECRET-TOKEN-abc123";
    let providers = [
        (
            "project.r-version",
            marker.to_owned(),
            RSourceOverride::VersionFile {
                file: "project.r-version".into(),
            },
        ),
        (
            "rproject.toml",
            format!("[project]\nr_version = \"{marker}\"\n"),
            RSourceOverride::TomlKey {
                file: "rproject.toml".into(),
                key: "project.r_version".to_string(),
            },
        ),
        (
            "renv.lock",
            format!(r#"{{"R":{{"Version":"{marker}"}}}}"#),
            RSourceOverride::JsonKey {
                file: "renv.lock".into(),
                key: "R.Version".to_string(),
            },
        ),
    ];

    for (file, contents, provider) in providers {
        let temp = tempfile::tempdir().unwrap();
        std::fs::write(temp.path().join(file), contents).unwrap();

        let diagnostics = fallback_diagnostic_text(&[provider], temp.path());

        assert!(!diagnostics.contains(marker), "provider file: {file}");
        assert!(
            diagnostics.contains("could not be parsed"),
            "provider file: {file}"
        );
    }
}

#[test]
fn malformed_files_do_not_disclose_their_contents_in_diagnostics() {
    let toml_marker = "SUPER-SECRET-TOML-CONTENTS";
    let json_marker = "SUPER-SECRET-JSON-CONTENTS";
    let cases = [
        (
            "rproject.toml",
            format!("[project]\nr_version = \"{toml_marker}\n"),
            RSourceOverride::TomlKey {
                file: "rproject.toml".into(),
                key: "project.r_version".to_string(),
            },
            toml_marker,
        ),
        (
            "renv.lock",
            format!(r#"{{"R":{{"Version":"{json_marker}"}}"#),
            RSourceOverride::JsonKey {
                file: "renv.lock".into(),
                key: "R.Version".to_string(),
            },
            json_marker,
        ),
    ];

    for (file, contents, provider, marker) in cases {
        let temp = tempfile::tempdir().unwrap();
        std::fs::write(temp.path().join(file), contents).unwrap();

        let diagnostics = fallback_diagnostic_text(&[provider], temp.path());

        assert!(
            diagnostics.contains(&format!(
                "Warning: Failed to parse R source override file {file}; trying the next R source override."
            )),
            "provider file: {file}"
        );
        assert!(!diagnostics.contains(marker), "provider file: {file}");
    }
}