From a1dce5e4785767ac785e8f6908d2785fb5f9b077 Mon Sep 17 00:00:00 2001
From: Jaeyeon Park <donionbs7@gmail.com>
Date: Sun, 6 Oct 2024 15:07:58 +0900
Subject: [PATCH] test: graphql server path injection

Signed-off-by: Jaeyeon Park <donionbs7@gmail.com>
---
 .../pkg/chaoshub/handler/handler_test.go      | 16 ++++++
 .../server/pkg/chaoshub/ops/gitops_test.go    | 52 ++++++++++++++++---
 2 files changed, 60 insertions(+), 8 deletions(-)

diff --git a/chaoscenter/graphql/server/pkg/chaoshub/handler/handler_test.go b/chaoscenter/graphql/server/pkg/chaoshub/handler/handler_test.go
index 1a30b1e012a..af686001bdf 100644
--- a/chaoscenter/graphql/server/pkg/chaoshub/handler/handler_test.go
+++ b/chaoscenter/graphql/server/pkg/chaoshub/handler/handler_test.go
@@ -157,6 +157,14 @@ func TestDownloadRemoteHub(t *testing.T) {
 			},
 			isError: true,
 		},
+		{
+			name:      "path injection",
+			projectID: uuid.New().String(),
+			chaosHub: model.CreateRemoteChaosHub{
+				Name:    uuid.New().String() + "../path/injection",
+				RepoURL: "https://github.com/litmuschaos/chaos-charts/archive/refs/heads/master.zip",
+			},
+		},
 	}
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -209,6 +217,14 @@ func TestSyncRemoteRepo(t *testing.T) {
 			},
 			isError: true,
 		},
+		{
+			name:      "path injection",
+			projectID: uuid.New().String(),
+			chaosHub: model.CloningInput{
+				Name:    uuid.New().String() + "../path/injection",
+				RepoURL: "https://github.com/litmuschaos/chaos-charts/archive/refs/heads/master.zip",
+			},
+		},
 	}
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_test.go b/chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_test.go
index 531c5510ea7..74999d756fd 100644
--- a/chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_test.go
+++ b/chaoscenter/graphql/server/pkg/chaoshub/ops/gitops_test.go
@@ -39,16 +39,52 @@ func clearCloneRepository(projectID string) {
 
 // TestGetClonePath is used to test the GetClonePath function
 func TestGetClonePath(t *testing.T) {
-	// given
 	projectID := uuid.New().String()
-	chaosHubConfig := chaosHubOps.ChaosHubConfig{
-		ProjectID: projectID,
-		HubName:   "test",
+
+	testCases := []struct {
+		name      string
+		projectID string
+		hubName   string
+		isDefault bool
+		expected  string
+	}{
+		{
+			name:      "default hub",
+			projectID: projectID,
+			hubName:   "defaultHub",
+			isDefault: true,
+			expected:  "/tmp/default/defaultHub",
+		},
+		{
+			name:      "non-default hub",
+			projectID: projectID,
+			hubName:   "testHub",
+			isDefault: false,
+			expected:  "/tmp/" + projectID + "/testHub",
+		},
+		{
+			name:      "path injection",
+			projectID: projectID,
+			hubName:   "testHub/../Path/Injection",
+			isDefault: false,
+			expected:  "/tmp/" + projectID + "/testHubPathInjection",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// given
+			chaosHubConfig := chaosHubOps.ChaosHubConfig{
+				ProjectID: tc.projectID,
+				HubName:   tc.hubName,
+				IsDefault: tc.isDefault,
+			}
+			// when
+			path := chaosHubOps.GetClonePath(chaosHubConfig)
+			// then
+			assert.Equal(t, tc.expected, path)
+		})
 	}
-	// when
-	path := chaosHubOps.GetClonePath(chaosHubConfig)
-	// then
-	assert.Equal(t, "/tmp/"+projectID+"/test", path)
 }
 
 // TestGitConfigConstruct is used to test the GitConfigConstruct function