blob: b4b83b70d1cab2c297d9454a9195e2c4ffdeacfd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
require 'spec_helper'
describe SystemCheck::App::GitUserDefaultSSHConfigCheck do
let(:username) { '_this_user_will_not_exist_unless_it_is_stubbed' }
let(:base_dir) { Dir.mktmpdir }
let(:home_dir) { File.join(base_dir, "/var/lib/#{username}") }
let(:ssh_dir) { File.join(home_dir, '.ssh') }
let(:forbidden_file) { 'id_rsa' }
before do
allow(Gitlab.config.gitlab).to receive(:user).and_return(username)
end
after do
FileUtils.rm_rf(base_dir)
end
it 'only whitelists safe files' do
expect(described_class::WHITELIST).to contain_exactly(
'authorized_keys',
'authorized_keys2',
'authorized_keys.lock',
'known_hosts'
)
end
describe '#skip?' do
subject { described_class.new.skip? }
where(user_exists: [true, false], home_dir_exists: [true, false])
with_them do
let(:expected_result) { !user_exists || !home_dir_exists }
before do
stub_user if user_exists
stub_home_dir if home_dir_exists
end
it { is_expected.to eq(expected_result) }
end
it 'skips GitLab read-only instances' do
stub_user
stub_home_dir
allow(Gitlab::Database).to receive(:read_only?).and_return(true)
is_expected.to be_truthy
end
end
describe '#check?' do
subject { described_class.new.check? }
before do
stub_user
end
it 'fails if a forbidden file exists' do
stub_ssh_file(forbidden_file)
is_expected.to be_falsy
end
it "succeeds if the SSH directory doesn't exist" do
FileUtils.rm_rf(ssh_dir)
is_expected.to be_truthy
end
it 'succeeds if all the whitelisted files exist' do
described_class::WHITELIST.each do |filename|
stub_ssh_file(filename)
end
is_expected.to be_truthy
end
end
def stub_user
allow(File).to receive(:expand_path).with("~#{username}").and_return(home_dir)
end
def stub_home_dir
FileUtils.mkdir_p(home_dir)
end
def stub_ssh_file(filename)
FileUtils.mkdir_p(ssh_dir)
FileUtils.touch(File.join(ssh_dir, filename))
end
end
|
