Fix favorites to consult allowlist #3526
Conversation
|
Need to take a look a the |
| `mkdir -p #{project_path}` | ||
| `mkdir -p #{project_path2}` | ||
| # regular directory now though? | ||
| #`mkdir -p #{s3_path}` |
There was a problem hiding this comment.
Can you expand more on what you mean by this? The next assertion passes when I uncomment this line, and it's the URLs that are wrong - and the problem there:
Which is what the old assertion was (but then if I change to the old assertion I still get S3 weirdness, so I want to investigate your thoughts behind this being commented out).
| p.remote? || p.path.directory? && p.path.readable? && p.path.executable? | ||
| Configuration.allowlist_paths.include?(p.path) && (p.remote? || p.path.directory?) && p.path.readable? && p.path.executable? |
There was a problem hiding this comment.
I think this is the source of the issues you're having with the tests.
This would evaluate to false. I.e., it does not account for child paths.
['/a'].include?('/a/b')
I think you need to use Allowlist.default.permitted?(p.path)
There was a problem hiding this comment.
What is Allowlist here?
There was a problem hiding this comment.
I replaced Configuration.allowlist_paths.include?(p.path) with AllowlistPolicy.default.permitted?(p.path) and there is still wonkiness with the way the S3 path is expanded in the test.
There was a problem hiding this comment.
Yep you found it - I pulled that from memory, should have been AllowlistPolicy
| @@ -20,7 +20,7 @@ def candidate_favorite_paths | |||
| # returns an array of other paths provided as shortcuts to the user | |||
| def favorite_paths | |||
| @favorite_paths ||= candidate_favorite_paths.select do |p| | |||
| p.remote? || p.path.directory? && p.path.readable? && p.path.executable? | |||
| AllowlistPolicy.default.permitted?(p.path) && (p.remote? || p.path.directory?) && p.path.readable? && p.path.executable? | |||
There was a problem hiding this comment.
I don't think remote locations adhere to these allowlists because they always check the local filesystem. That is, remote filesystems are always allowed.
So maybe this turns into something like this:
if p.remote?
true
else
AllowlistPolicy.default.permitted?(p.path) && p.path.directory? && p.path.readable? && p.path.executable?
end
Fixes #3193