| | 1 | #!/bin/sh |
| | 2 | # |
| | 3 | # Ensure that we do not modify file:/// uris (regression test for |
| | 4 | # CVE-2014-0487 |
| | 5 | # |
| | 6 | set -e |
| | 7 | |
| | 8 | TESTDIR="$(readlink -f "$(dirname "$0")")" |
| | 9 | . "$TESTDIR/framework" |
| | 10 | |
| | 11 | setupenvironment |
| | 12 | configarchitecture "amd64" |
| | 13 | configcompression 'bz2' 'gz' |
| | 14 | confighashes 'SHA512' |
| | 15 | |
| | 16 | insertpackage 'unstable' 'foo' 'all' '1' |
| | 17 | insertpackage 'unstable' 'bar' 'amd64' '1' |
| | 18 | insertsource 'unstable' 'foo' 'all' '1' |
| | 19 | |
| | 20 | setupaptarchive --no-update |
| | 21 | |
| | 22 | # ensure the archive is not writable |
| | 23 | addtrap 'prefix' 'chmod 755 aptarchive/dists/unstable/main/binary-all;' |
| | 24 | if [ "$(id -u)" = '0' ]; then |
| | 25 | # too deep to notice it, but it also unlikely that files in the same repo have different permissions |
| | 26 | chmod 500 aptarchive/dists/unstable/main/binary-all |
| | 27 | testfailure aptget update |
| | 28 | rm -rf rootdir/var/lib/apt/lists |
| | 29 | chmod 755 aptarchive/dists/unstable/main/binary-all |
| | 30 | testsuccess aptget update |
| | 31 | rm -rf rootdir/var/lib/apt/lists |
| | 32 | chmod 511 aptarchive/dists/ |
| | 33 | testsuccess aptget update |
| | 34 | rm -rf rootdir/var/lib/apt/lists |
| | 35 | chmod 510 aptarchive/dists/ |
| | 36 | testsuccesswithnotice aptget update |
| | 37 | rm -rf rootdir/var/lib/apt/lists |
| | 38 | chmod 500 aptarchive/dists/ |
| | 39 | testsuccesswithnotice aptget update |
| | 40 | exit |
| | 41 | fi |
| | 42 | chmod 555 aptarchive/dists/unstable/main/binary-all |
| | 43 | testsuccess aptget update |
| | 44 | |
| | 45 | # the release files aren't an IMS-hit, but the indexes are |
| | 46 | redatereleasefiles '+1 hour' |
| | 47 | |
| | 48 | # we don't download the index if it isn't updated |
| | 49 | testsuccess aptget update -o Debug::pkgAcquire::Auth=1 |
| | 50 | # file:/ isn't shown in the log, so see if it was downloaded anyhow |
| | 51 | cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output |
| | 52 | canary="SHA512:$(bzcat aptarchive/dists/unstable/main/binary-all/Packages.bz2 | sha512sum |cut -f1 -d' ')" |
| | 53 | testfailure grep -- "$canary" rootdir/tmp/update.output |
| | 54 | |
| | 55 | testfoo() { |
| | 56 | # foo is still available |
| | 57 | testsuccess aptget install -s foo |
| | 58 | testsuccess aptcache showsrc foo |
| | 59 | testsuccess aptget source foo --print-uris |
| | 60 | } |
| | 61 | testfoo |
| | 62 | |
| | 63 | # the release file is new again, the index still isn't, but it is somehow gone now from disk |
| | 64 | redatereleasefiles '+2 hour' |
| | 65 | find rootdir/var/lib/apt/lists -name '*_Packages*' -delete |
| | 66 | |
| | 67 | testsuccess aptget update -o Debug::pkgAcquire::Auth=1 |
| | 68 | # file:/ isn't shown in the log, so see if it was downloaded anyhow |
| | 69 | cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output |
| | 70 | canary="SHA512:$(bzcat aptarchive/dists/unstable/main/binary-all/Packages.bz2 | sha512sum |cut -f1 -d' ')" |
| | 71 | testsuccess grep -- "$canary" rootdir/tmp/update.output |
| | 72 | |
| | 73 | testfoo |
projects / apt.git / blame_incremental