@@ -153,14 +153,18 @@ func TestCopyToWorkspaceRejectsPathTraversal(t *testing.T) {
153153 if err := os .Mkdir (victimDir , 0700 ); err != nil {
154154 t .Fatal (err )
155155 }
156+ before , err := os .Stat (victimDir )
157+ if err != nil {
158+ t .Fatal (err )
159+ }
156160 source := filepath .Join (root , "source" )
157161 if err := os .WriteFile (source , []byte ("attacker content" ), 0600 ); err != nil {
158162 t .Fatal (err )
159163 }
160164
161165 creator := & dockerBindWorkspaceCreator {}
162166 workspace := & dockerBindWorkspace {dir : workspaceDir }
163- err : = creator .copyToWorkspace (context .Background (), workspace , map [string ]string {
167+ err = creator .copyToWorkspace (context .Background (), workspace , map [string ]string {
164168 "../victim/.gitignore" : source ,
165169 })
166170 if err == nil || ! strings .Contains (err .Error (), "outside the workspace" ) {
@@ -173,8 +177,8 @@ func TestCopyToWorkspaceRejectsPathTraversal(t *testing.T) {
173177 if err != nil {
174178 t .Fatal (err )
175179 }
176- if got := info .Mode ().Perm (); got != 0700 {
177- t .Fatalf ("outside directory permissions changed: got %o, want 700 " , got )
180+ if got , want := info .Mode ().Perm (), before . Mode (). Perm () ; got != want {
181+ t .Fatalf ("outside directory permissions changed: got %o, want %o " , got , want )
178182 }
179183}
180184
0 commit comments