mini-docs 0.4.5

A minimal, secure build-time Markdown to HTML generator for the mini-* family.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

use super::*;

#[test]
fn rejects_parent_dir_traversal() {
    let output_dir = Path::new("/srv/mini-docs-output");
    let malicious = Path::new("../../evil.html");

    let err = guard_output_path(output_dir, malicious).expect_err("traversal must be rejected");

    assert!(matches!(err, DocError::Escape(_)));
}

#[test]
fn rejects_traversal_in_middle_of_path() {
    let output_dir = Path::new("/srv/mini-docs-output");
    let malicious = Path::new("guide/../../evil.html");

    let err =
        guard_output_path(output_dir, malicious).expect_err("mid-path traversal must be rejected");

    assert!(matches!(err, DocError::Escape(_)));
}

#[test]
fn rejects_absolute_relative_path() {
    let output_dir = Path::new("/srv/mini-docs-output");
    let malicious = Path::new("/etc/evil.html");

    let err = guard_output_path(output_dir, malicious).expect_err("absolute path must be rejected");

    assert!(matches!(err, DocError::Escape(_)));
}

#[test]
fn accepts_ordinary_nested_relative_path() {
    let output_dir = Path::new("/srv/mini-docs-output");
    let ok_path = Path::new("guide/setup.html");

    let joined = guard_output_path(output_dir, ok_path).expect("ordinary path is fine");

    assert_eq!(joined, output_dir.join("guide/setup.html"));
}