vaultic 1.0.0

Secure your secrets. Sync your team. Trust your configs.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

use std::path::{Path, PathBuf};
use std::sync::OnceLock;

use crate::core::errors::{Result, VaulticError};

static VAULTIC_DIR: OnceLock<PathBuf> = OnceLock::new();

/// Initialize the global vaultic directory path.
/// If `custom` is provided, uses that path; otherwise defaults to `.vaultic`.
pub fn init(custom: Option<&str>) {
    let dir = custom
        .map(PathBuf::from)
        .unwrap_or_else(|| PathBuf::from(".vaultic"));
    let _ = VAULTIC_DIR.set(dir);
}

/// Get the current vaultic directory path.
pub fn vaultic_dir() -> &'static Path {
    VAULTIC_DIR
        .get()
        .map(|p| p.as_path())
        .unwrap_or(Path::new(".vaultic"))
}

/// Validate that an environment name is safe for path construction.
///
/// Prevents path traversal attacks by restricting names to `[a-zA-Z0-9_-]`.
/// For example, `--env ../../../etc` would construct `.vaultic/../../../etc.env.enc`
/// and escape the project directory.
pub fn validate_env_name(name: &str) -> Result<()> {
    if name.is_empty() {
        return Err(VaulticError::InvalidConfig {
            detail: "Environment name cannot be empty.\n\n  \
                     Use a name like 'dev', 'staging', or 'prod'."
                .into(),
        });
    }

    if !name
        .chars()
        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
    {
        return Err(VaulticError::InvalidConfig {
            detail: format!(
                "Invalid environment name: '{name}'\n\n  \
                 Environment names can only contain letters, digits, hyphens, and underscores.\n  \
                 Valid examples: 'dev', 'staging', 'prod-us', 'test_01'"
            ),
        });
    }

    Ok(())
}

/// Validate that a filename is safe and does not contain path separators.
///
/// Prevents a compromised `config.toml` from writing files outside `.vaultic/`.
pub fn validate_simple_filename(name: &str, context: &str) -> Result<()> {
    if name.is_empty() {
        return Err(VaulticError::InvalidConfig {
            detail: format!("{context} cannot be empty."),
        });
    }

    if name.contains('/') || name.contains('\\') || name.contains("..") || name.starts_with('.') {
        return Err(VaulticError::InvalidConfig {
            detail: format!(
                "Unsafe {context}: '{name}'\n\n  \
                 The value must be a simple filename without path separators.\n  \
                 Valid examples: 'audit.log', 'vaultic-audit.log'"
            ),
        });
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn valid_env_names() {
        assert!(validate_env_name("dev").is_ok());
        assert!(validate_env_name("staging").is_ok());
        assert!(validate_env_name("prod").is_ok());
        assert!(validate_env_name("prod-us").is_ok());
        assert!(validate_env_name("test_01").is_ok());
        assert!(validate_env_name("A").is_ok());
    }

    #[test]
    fn rejects_path_traversal() {
        assert!(validate_env_name("../../../etc").is_err());
        assert!(validate_env_name("..").is_err());
        assert!(validate_env_name("foo/bar").is_err());
        assert!(validate_env_name("foo\\bar").is_err());
    }

    #[test]
    fn rejects_empty_env_name() {
        assert!(validate_env_name("").is_err());
    }

    #[test]
    fn rejects_special_characters() {
        assert!(validate_env_name("dev;rm -rf").is_err());
        assert!(validate_env_name("prod env").is_err());
        assert!(validate_env_name("dev.staging").is_err());
    }

    #[test]
    fn valid_simple_filenames() {
        assert!(validate_simple_filename("audit.log", "log file").is_ok());
        assert!(validate_simple_filename("vaultic-audit.log", "log file").is_ok());
        assert!(validate_simple_filename("log", "log file").is_ok());
    }

    #[test]
    fn rejects_path_in_filename() {
        assert!(validate_simple_filename("../secret.log", "log file").is_err());
        assert!(validate_simple_filename("/etc/passwd", "log file").is_err());
        assert!(validate_simple_filename("foo\\bar.log", "log file").is_err());
        assert!(validate_simple_filename("..\\..\\etc", "log file").is_err());
    }

    #[test]
    fn rejects_hidden_files() {
        assert!(validate_simple_filename(".hidden", "log file").is_err());
    }

    #[test]
    fn rejects_empty_filename() {
        assert!(validate_simple_filename("", "log file").is_err());
    }
}