The_Great_Archive/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-09-14 11:06:15 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

test: cover duplicate SFTP host-key override

Browse Source
This commit is contained in:
Furox 2026-09-05 01:19:18 +03:00 committed by Furox88
parent 05b75ffa1a
commit e753233b36
1 changed files with 40 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
apps/dokploy/__test__/utils/issue-416-path-safety.test.ts
View File

@ -1,3 +1,4 @@
import { apiCreateDestination } from "@dokploy/server/db/schema/destination";
import { RCLONE_DESTINATION_PROVIDERS } from "@dokploy/server/db/validations/destination";
import { redactRcloneCredentials } from "@dokploy/server/utils/backups/redact";
import {
@ -59,6 +60,44 @@ describe("issue #416 rclone path safety", () => {
});
});
describe("issue #416 SFTP host-key safety", () => {
const conflictingKnownHostsFlags = [
"--sftp-known-hosts-file=/etc/ssh/ssh_known_hosts",
"--sftp-known-hosts-file=none",
];
test("rejects conflicting host-key flags during destination validation", () => {
const result = apiCreateDestination.safeParse({
name: "SFTP backups",
provider: RCLONE_DESTINATION_PROVIDERS.SFTP,
accessKey: "backup-user",
secretAccessKey: "",
bucket: "backups",
region: "",
endpoint: "storage.example.com",
additionalFlags: conflictingKnownHostsFlags,
});
expect(result.success).toBe(false);
});
test("rejects conflicting host-key flags at runtime", async () => {
await expect(
getRclonePathAndFlags(
destination({
provider: RCLONE_DESTINATION_PROVIDERS.SFTP,
endpoint: "storage.example.com",
accessKey: "backup-user",
secretAccessKey: "",
region: "",
bucket: "backups",
additionalFlags: conflictingKnownHostsFlags,
}),
),
).rejects.toThrow("SFTP destinations must verify the server host key");
});
});
describe("issue #416 credential redaction", () => {
test("redacts an SFTP private-key passphrase flag", () => {
const command =
@ -68,4 +107,4 @@ describe("issue #416 credential redaction", () => {
expect(redacted).not.toContain("obscured-secret");
expect(redacted).toContain('--sftp-key-file-pass="[REDACTED]"');
});
});
});