juli/OrcaSlicer
1
1
Fork 0
mirror of https://github.com/OrcaSlicer/OrcaSlicer.git synced 2026-09-16 21:42:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: plugin audit blocking files in .config folder e.g. .config/OrcaSlicer

Browse Source
This commit is contained in:
Ian Chua
2026-09-01 17:06:36 +08:00
parent 9933cab59f
commit c84591549e
3 changed files with 163 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/slic3rutils/test_plugin_audit.cpp
+37
View File
@@ -184,6 +184,43 @@ TEST_CASE("Plugin audit deny beats a plugin's own scoped root", "[audit]")
}
}
TEST_CASE("Plugin audit allows an allowed root below a configuration directory", "[audit][Regression]")
{
ScopedDataDir data_dir_guard("plugin-audit-config-parent");
seed_denied_names();
seed_denied_keywords();
// This mirrors Linux's default ~/.config/OrcaSlicer layout without depending on the host's
// actual home directory or XDG_CONFIG_HOME setting.
const fs::path linux_data_dir = data_dir_guard.dir / ".config" / "OrcaSlicer";
const fs::path plugin_storage = linux_data_dir / "orca_plugins" / "plugin_data" / "test_plugin";
fs::create_directories(plugin_storage);
set_data_dir(linux_data_dir.string());
PluginAuditManager& mgr = PluginAuditManager::instance();
mgr.add_global_allowed_root(data_dir());
ScopedPluginAuditContext ctx("test_plugin", "");
SECTION("plugin storage remains accessible")
{
CHECK(mgr.check_open((plugin_storage / "state.json").string(), "w").allowed);
}
SECTION("all plugin storage names remain accessible")
{
CHECK(mgr.check_open((plugin_storage / "config" / "settings.json").string(), "r").allowed);
CHECK(mgr.check_open((plugin_storage / "secret" / "token.txt").string(), "w").allowed);
CHECK(mgr.check_open((plugin_storage / (SLIC3R_APP_KEY ".conf")).string(), "r").allowed);
}
SECTION("host-owned protected files remain denied")
{
const AuditDecision decision = mgr.check_open((linux_data_dir / (SLIC3R_APP_KEY ".conf")).string(), "r");
CHECK_FALSE(decision.allowed);
CHECK(decision.reason == "denied filename");
}
}
TEST_CASE("Plugin audit does not constrain non-plugin code", "[audit]")
{
ScopedDataDir data_dir_guard("plugin-audit-noplugin");