-
Notifications
You must be signed in to change notification settings - Fork 141
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support for xdg_cache_home env variable, enforce secure dir permissions
- Loading branch information
1 parent
f5e1862
commit 47b6333
Showing
9 changed files
with
572 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
114 changes: 114 additions & 0 deletions
114
Snowflake.Data.Tests/UnitTests/CredentialManager/SFCredentialManagerFileStorageTest.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| /* | ||
| * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved. | ||
| */ | ||
|
|
||
| using System; | ||
| using System.IO; | ||
| using NUnit.Framework; | ||
| using Moq; | ||
| using Snowflake.Data.Core.CredentialManager.Infrastructure; | ||
| using Snowflake.Data.Core.Tools; | ||
|
|
||
|
|
||
| namespace Snowflake.Data.Tests.UnitTests.CredentialManager | ||
| { | ||
| [TestFixture] | ||
| public class SFCredentialManagerFileStorageTest | ||
| { | ||
| private const string SnowflakeCacheLocation = "/Users/snowflake/cache"; | ||
| private const string CommonCacheLocation = "/Users/snowflake/.cache"; | ||
| private const string HomeLocation = "/Users/snowflake"; | ||
|
|
||
| [ThreadStatic] | ||
| private static Mock<EnvironmentOperations> t_environmentOperations; | ||
|
|
||
| [SetUp] | ||
| public void SetUp() | ||
| { | ||
| t_environmentOperations = new Mock<EnvironmentOperations>(); | ||
| } | ||
|
|
||
| [Test] | ||
| public void TestChooseLocationFromSnowflakeCacheEnvironmentVariable() | ||
| { | ||
| // arrange | ||
| MockSnowflakeCacheEnvironmentVariable(); | ||
| MockCommonCacheEnvironmentVariable(); | ||
| MockHomeLocation(); | ||
|
|
||
| // act | ||
| var fileStorage = new SFCredentialManagerFileStorage(t_environmentOperations.Object); | ||
|
|
||
| // assert | ||
| AssertFileStorageForLocation(SnowflakeCacheLocation, fileStorage); | ||
| } | ||
|
|
||
| [Test] | ||
| public void TestChooseLocationFromCommonCacheEnvironmentVariable() | ||
| { | ||
| // arrange | ||
| MockCommonCacheEnvironmentVariable(); | ||
| MockHomeLocation(); | ||
| var expectedLocation = Path.Combine(CommonCacheLocation, SFCredentialManagerFileStorage.CredentialCacheDirName); | ||
|
|
||
| // act | ||
| var fileStorage = new SFCredentialManagerFileStorage(t_environmentOperations.Object); | ||
|
|
||
| // assert | ||
| AssertFileStorageForLocation(expectedLocation, fileStorage); | ||
| } | ||
|
|
||
| [Test] | ||
| public void TestChooseLocationFromHomeFolder() | ||
| { | ||
| // arrange | ||
| MockHomeLocation(); | ||
| var expectedLocation = Path.Combine(HomeLocation, SFCredentialManagerFileStorage.CommonCacheDirectoryName, SFCredentialManagerFileStorage.CredentialCacheDirName); | ||
|
|
||
| // act | ||
| var fileStorage = new SFCredentialManagerFileStorage(t_environmentOperations.Object); | ||
|
|
||
| // assert | ||
| AssertFileStorageForLocation(expectedLocation, fileStorage); | ||
| } | ||
|
|
||
| [Test] | ||
| public void TestFailWhenLocationCannotBeIdentified() | ||
| { | ||
| // act | ||
| var thrown = Assert.Throws<Exception>(() => new SFCredentialManagerFileStorage(t_environmentOperations.Object)); | ||
|
|
||
| // assert | ||
| Assert.That(thrown.Message, Contains.Substring("Unable to identify credential cache directory")); | ||
| } | ||
|
|
||
| private void AssertFileStorageForLocation(string directory, SFCredentialManagerFileStorage fileStorage) | ||
| { | ||
| Assert.NotNull(fileStorage); | ||
| Assert.AreEqual(directory, fileStorage.JsonCacheDirectory); | ||
| Assert.AreEqual(Path.Combine(directory, SFCredentialManagerFileStorage.CredentialCacheFileName), fileStorage.JsonCacheFilePath); | ||
| Assert.AreEqual(Path.Combine(directory, SFCredentialManagerFileStorage.CredentialCacheLockName), fileStorage.JsonCacheLockPath); | ||
| } | ||
|
|
||
| private void MockSnowflakeCacheEnvironmentVariable() | ||
| { | ||
| t_environmentOperations | ||
| .Setup(e => e.GetEnvironmentVariable(SFCredentialManagerFileStorage.CredentialCacheDirectoryEnvironmentName)) | ||
| .Returns(SnowflakeCacheLocation); | ||
| } | ||
|
|
||
| private void MockCommonCacheEnvironmentVariable() | ||
| { | ||
| t_environmentOperations | ||
| .Setup(e => e.GetEnvironmentVariable(SFCredentialManagerFileStorage.CommonCacheDirectoryEnvironmentName)) | ||
| .Returns(CommonCacheLocation); | ||
| } | ||
|
|
||
| private void MockHomeLocation() | ||
| { | ||
| t_environmentOperations | ||
| .Setup(e => e.GetFolderPath(Environment.SpecialFolder.UserProfile)) | ||
| .Returns(HomeLocation); | ||
| } | ||
| } | ||
| } |
95 changes: 95 additions & 0 deletions
95
Snowflake.Data.Tests/UnitTests/Tools/DirectoryUnixInformationTest.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| /* | ||
| * Copyright (c) 2024 Snowflake Computing Inc. All rights reserved. | ||
| */ | ||
|
|
||
| using System.IO; | ||
| using Mono.Unix; | ||
| using NUnit.Framework; | ||
| using Snowflake.Data.Core.Tools; | ||
|
|
||
| namespace Snowflake.Data.Tests.UnitTests.Tools | ||
| { | ||
| [TestFixture] | ||
| public class DirectoryUnixInformationTest | ||
| { | ||
| private const long UserId = 5; | ||
| private const long AnotherUserId = 6; | ||
| static readonly string s_directoryFullName = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName()); | ||
|
|
||
| [Test] | ||
| [TestCase(FileAccessPermissions.UserWrite)] | ||
| [TestCase(FileAccessPermissions.UserRead)] | ||
| [TestCase(FileAccessPermissions.UserExecute)] | ||
| [TestCase(FileAccessPermissions.UserReadWriteExecute)] | ||
| public void TestSafeDirectory(FileAccessPermissions securePermissions) | ||
| { | ||
| // arrange | ||
| var dirInfo = new DirectoryUnixInformation(s_directoryFullName, true, securePermissions, UserId); | ||
|
|
||
| // act | ||
| var isSafe = dirInfo.IsSafe(UserId); | ||
|
|
||
| // assert | ||
| Assert.True(isSafe); | ||
| } | ||
|
|
||
| [Test] | ||
| [TestCase(FileAccessPermissions.UserReadWriteExecute | FileAccessPermissions.GroupRead)] | ||
| [TestCase(FileAccessPermissions.UserReadWriteExecute | FileAccessPermissions.OtherRead)] | ||
| public void TestUnsafePermissions(FileAccessPermissions unsecurePermissions) | ||
| { | ||
| // arrange | ||
| var dirInfo = new DirectoryUnixInformation(s_directoryFullName, true, unsecurePermissions, UserId); | ||
|
|
||
| // act | ||
| var isSafe = dirInfo.IsSafe(UserId); | ||
|
|
||
| // assert | ||
| Assert.False(isSafe); | ||
| } | ||
|
|
||
| [Test] | ||
| public void TestSafeExactlyDirectory() | ||
| { | ||
| // arrange | ||
| var dirInfo = new DirectoryUnixInformation(s_directoryFullName, true, FileAccessPermissions.UserReadWriteExecute, UserId); | ||
|
|
||
| // act | ||
| var isSafe = dirInfo.IsSafeExactly(UserId); | ||
|
|
||
| // assert | ||
| Assert.True(isSafe); | ||
| } | ||
|
|
||
| [Test] | ||
| [TestCase(FileAccessPermissions.UserRead)] | ||
| [TestCase(FileAccessPermissions.UserReadWriteExecute | FileAccessPermissions.GroupRead)] | ||
| [TestCase(FileAccessPermissions.UserReadWriteExecute | FileAccessPermissions.OtherRead)] | ||
| public void TestUnsafeExactlyPermissions(FileAccessPermissions unsecurePermissions) | ||
| { | ||
| // arrange | ||
| var dirInfo = new DirectoryUnixInformation(s_directoryFullName, true, unsecurePermissions, UserId); | ||
|
|
||
| // act | ||
| var isSafe = dirInfo.IsSafeExactly(UserId); | ||
|
|
||
| // assert | ||
| Assert.False(isSafe); | ||
| } | ||
|
|
||
| [Test] | ||
| public void TestOwnedByOthers() | ||
| { | ||
| // arrange | ||
| var dirInfo = new DirectoryUnixInformation(s_directoryFullName, true, FileAccessPermissions.UserReadWriteExecute, UserId); | ||
|
|
||
| // act | ||
| var isSafe = dirInfo.IsSafe(AnotherUserId); | ||
| var isSafeExactly = dirInfo.IsSafeExactly(AnotherUserId); | ||
|
|
||
| // assert | ||
| Assert.False(isSafe); | ||
| Assert.False(isSafeExactly); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.