ic-query 0.29.3

Internet Computer query library for NNS, SNS, ICRC, system canisters, and public network metadata
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

use super::*;
use crate::test_support::temp_dir;
use std::{fs, path::Path};

#[cfg(unix)]
use std::os::unix::fs::{PermissionsExt, symlink};

#[test]
fn managed_round_trip_uses_owner_only_modes() {
    let root = temp_dir("ic-query-confined-round-trip");
    let path = root.join("nns/ic/report.json");

    write_managed_text_atomically(&root, &path, "evidence").expect("write managed cache");

    assert_eq!(
        read_managed_text(&root, &path).expect("read managed cache"),
        Some("evidence".to_string())
    );
    #[cfg(unix)]
    {
        assert_eq!(
            fs::metadata(&root)
                .expect("root metadata")
                .permissions()
                .mode()
                & 0o777,
            0o700
        );
        assert_eq!(
            fs::metadata(&path)
                .expect("file metadata")
                .permissions()
                .mode()
                & 0o777,
            0o600
        );
    }
    let _ = fs::remove_dir_all(root);
}

#[test]
fn managed_path_rejects_escape() {
    let root = temp_dir("ic-query-confined-escape");
    let path = root.join("../outside.json");

    let error = write_managed_text_atomically(&root, &path, "evidence")
        .expect_err("parent traversal rejected");

    assert!(matches!(error, CacheFileError::Confinement { .. }));

    let outside = temp_dir("ic-query-confined-absolute-outside").join("cache.json");
    let outside_error = write_managed_text_atomically(&root, &outside, "evidence")
        .expect_err("absolute outside path rejected");
    assert!(matches!(outside_error, CacheFileError::Confinement { .. }));
    assert!(!outside.exists());
    let _ = fs::remove_dir_all(root);
}

#[cfg(unix)]
#[test]
fn managed_path_rejects_symlinked_parent_and_file() {
    let root = temp_dir("ic-query-confined-symlink");
    let outside = temp_dir("ic-query-confined-outside");
    fs::create_dir_all(&outside).expect("create outside");
    fs::set_permissions(&outside, fs::Permissions::from_mode(0o700)).expect("secure outside");
    write_managed_text_atomically(&root, &root.join("seed.json"), "seed").expect("create root");

    symlink(&outside, root.join("linked-dir")).expect("link directory");
    let parent_error = read_managed_text(&root, &root.join("linked-dir/cache.json"))
        .expect_err("symlink parent rejected");
    assert!(matches!(parent_error, CacheFileError::Confinement { .. }));

    fs::write(outside.join("target.json"), "outside").expect("write outside target");
    symlink(outside.join("target.json"), root.join("linked.json")).expect("link file");
    let file_error =
        read_managed_text(&root, &root.join("linked.json")).expect_err("symlink file rejected");
    assert!(matches!(file_error, CacheFileError::Confinement { .. }));

    let linked_root = temp_dir("ic-query-confined-root-link");
    symlink(&outside, &linked_root).expect("link cache root");
    let root_error = read_managed_text(&linked_root, &linked_root.join("target.json"))
        .expect_err("symlink root rejected");
    assert!(matches!(root_error, CacheFileError::Confinement { .. }));

    let _ = fs::remove_dir_all(root);
    let _ = fs::remove_file(linked_root);
    let _ = fs::remove_dir_all(outside);
}

#[cfg(unix)]
#[test]
fn managed_path_rejects_unsafe_directory_and_file_modes() {
    let root = temp_dir("ic-query-confined-mode");
    let directory = root.join("nns");
    let path = directory.join("cache.json");
    write_managed_text_atomically(&root, &path, "evidence").expect("write managed cache");

    fs::set_permissions(&path, fs::Permissions::from_mode(0o644)).expect("widen file mode");
    let file_error = read_managed_text(&root, &path).expect_err("unsafe file mode rejected");
    assert!(matches!(
        file_error,
        CacheFileError::UnsafeManagedPermissions {
            actual_mode: 0o644,
            ..
        }
    ));

    fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).expect("restore file mode");
    fs::set_permissions(&directory, fs::Permissions::from_mode(0o755))
        .expect("widen managed directory mode");
    let directory_error =
        managed_file_exists(&root, &path).expect_err("unsafe managed directory rejected");
    assert!(matches!(
        directory_error,
        CacheFileError::UnsafeManagedPermissions {
            actual_mode: 0o755,
            ..
        }
    ));

    fs::set_permissions(&directory, fs::Permissions::from_mode(0o700))
        .expect("restore managed directory mode");
    fs::set_permissions(&root, fs::Permissions::from_mode(0o755)).expect("widen root mode");
    let root_error = managed_file_exists(&root, &path).expect_err("unsafe root mode rejected");
    assert!(matches!(
        root_error,
        CacheFileError::UnsafeManagedPermissions {
            actual_mode: 0o755,
            ..
        }
    ));

    fs::set_permissions(&root, fs::Permissions::from_mode(0o700)).expect("restore root mode");
    let _ = fs::remove_dir_all(root);
}

#[test]
fn missing_root_and_file_are_observed_without_creation() {
    let root = temp_dir("ic-query-confined-missing");
    let path = root.join("cache.json");

    assert_eq!(read_managed_file(&root, &path).expect("missing read"), None);
    assert!(!Path::new(&root).exists());
}