daniel/reasampler
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix the package fs seam: UTF-8 paths, GetUserFileName pickers, exclusive-create landing, rollback arm/disarm

Browse Source 
Both pickers now ride GetUserFileName (mode 0/1); the "no save picker" premise was false.
Landing uses O_EXCL so the create is the existence check, not a TOCTOU pair.
This commit is contained in:
Daniel Harvey
2026-08-02 08:15:12 -04:00
parent 41a3016e63
commit edfd7ead4d
11 changed files with 532 additions and 253 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_package_io.cpp
+141 -32
View File
@@ -1,12 +1,11 @@
// Standalone tests for shell/package/package_io — no REAPER, no framework. Pins the
// two properties the seam exists for: an interrupted or failed write leaves the
// destination absent or holding its prior contents (failure injected at the writer
// seam — abandonment, open failure, rename failure), and a multi-entry round trip
// holds at most one entry's payload, asserted against PayloadBuffer::alive() — the
// seam counter — rather than a memory measurement.
// Standalone tests for shell/package/package_io — no REAPER, no framework. Failure is
// injected at the writer seam (abandonment, open failure, rename failure) rather than
// simulated, and the streaming claim is asserted against PayloadBuffer::alive().
#include "../src/shell/package/package_io.h"
#include "../src/shell/package/package_path.h"
#include <algorithm>
#include <cstdio>
#include <filesystem>
#include <fstream>
@@ -28,19 +27,31 @@ static std::vector<std::uint8_t> patternBytes(std::size_t n, std::uint8_t seed)
return v;
}
static bool sameBytes(const PayloadBuffer& p, const std::vector<std::uint8_t>& want) {
return p.size() == want.size() &&
(want.empty() || std::equal(want.begin(), want.end(), p.data()));
}
static void writeScratchFile(const std::string& path,
const std::vector<std::uint8_t>& bytes) {
std::ofstream f(path, std::ios::binary | std::ios::trunc);
std::ofstream f(utf8Path(path), std::ios::binary | std::ios::trunc);
f.write(reinterpret_cast<const char*>(bytes.data()),
static_cast<std::streamsize>(bytes.size()));
}
static std::vector<std::uint8_t> readAll(const std::string& path) {
std::ifstream f(path, std::ios::binary);
std::ifstream f(utf8Path(path), std::ios::binary);
return std::vector<std::uint8_t>(std::istreambuf_iterator<char>(f),
std::istreambuf_iterator<char>());
}
static bool exists(const std::string& path) { return fs::exists(utf8Path(path)); }
static void removeQuietly(const std::string& path) {
std::error_code ec;
fs::remove(utf8Path(path), ec);
}
static void testPayloadCounterTracksMovesNotCopies() {
CHECK(PayloadBuffer::alive() == 0);
{
@@ -81,7 +92,7 @@ static void testStreamingRoundTripHoldsOnePayload() {
std::uint64_t offset = header.size();
for (std::size_t i = 0; i < entries.size(); ++i) {
PayloadBuffer p = readFilePayload(srcs[i]);
CHECK(p.bytes() == entries[i]);
CHECK(sameBytes(p, entries[i]));
CHECK(PayloadBuffer::alive() == 1); // exactly one entry in memory
CHECK(writer.appendPayload(p));
layout.emplace_back(offset, p.size());
@@ -91,8 +102,8 @@ static void testStreamingRoundTripHoldsOnePayload() {
CHECK(writer.commit());
CHECK(!writer.commit()); // a second commit is refused
}
CHECK(!fs::exists(dest + ".rsbanktmp"));
CHECK(fs::exists(dest));
CHECK(!exists(dest + ".rsbanktmp"));
CHECK(exists(dest));
{
// Scoped: the reader holds the file open, and Windows refuses to delete an
@@ -103,14 +114,36 @@ static void testStreamingRoundTripHoldsOnePayload() {
for (std::size_t i = 0; i < entries.size(); ++i) {
PayloadBuffer p = reader.readRange(layout[i].first, layout[i].second);
CHECK(PayloadBuffer::alive() == 1); // one entry per readRange, no more
CHECK(p.bytes() == entries[i]);
CHECK(sameBytes(p, entries[i]));
}
CHECK(PayloadBuffer::alive() == 0);
}
std::error_code ec;
for (const std::string& s : srcs) fs::remove(s, ec);
fs::remove(dest, ec);
for (const std::string& s : srcs) removeQuietly(s);
removeQuietly(dest);
}
static void testEmptyPayloadIsRefusedAndPoisonsTheWriter() {
// The failure this guards: an unreadable source yields an empty payload, and a
// verb that trusted a `true` here would commit framing claiming bytes nobody wrote.
const std::string dest = "pkg_io_emptypayload.rsbank";
{
PackageFileWriter writer(dest);
const std::vector<std::uint8_t> head = patternBytes(4, 1);
CHECK(writer.appendRaw(head.data(), head.size()));
CHECK(!writer.appendPayload(PayloadBuffer{}));
CHECK(!writer.ok());
CHECK(!writer.commit()); // the short stream can never reach the destination
}
CHECK(!exists(dest));
CHECK(!exists(dest + ".rsbanktmp"));
// A zero-length appendRaw stays tolerated — framing has legitimate empty edges.
{
PackageFileWriter writer(dest);
CHECK(writer.appendRaw(nullptr, 0));
CHECK(writer.ok());
writer.abort();
}
}
static void testAbandonedWriteLeavesNoDestination() {
@@ -121,8 +154,8 @@ static void testAbandonedWriteLeavesNoDestination() {
CHECK(writer.appendRaw(some.data(), some.size()));
// no commit — destruction is the injected interruption
}
CHECK(!fs::exists(dest));
CHECK(!fs::exists(dest + ".rsbanktmp"));
CHECK(!exists(dest));
CHECK(!exists(dest + ".rsbanktmp"));
}
static void testAbortPreservesPriorContents() {
@@ -138,9 +171,26 @@ static void testAbortPreservesPriorContents() {
CHECK(!writer.commit());
}
CHECK(readAll(dest) == prior);
CHECK(!fs::exists(dest + ".rsbanktmp"));
std::error_code ec;
fs::remove(dest, ec);
CHECK(!exists(dest + ".rsbanktmp"));
removeQuietly(dest);
}
static void testCommitReplacesAnExistingFile() {
// The module's one deliberate asymmetry against LandedFileJournal's never-overwrite
// rule: the save dialog's overwrite confirm is the consent, so commit() replaces.
const std::string dest = "pkg_io_replace.rsbank";
const std::vector<std::uint8_t> prior = patternBytes(40, 0x11);
const std::vector<std::uint8_t> fresh = patternBytes(7, 0x22);
writeScratchFile(dest, prior);
{
PackageFileWriter writer(dest);
CHECK(writer.ok());
CHECK(writer.appendRaw(fresh.data(), fresh.size()));
CHECK(writer.commit());
}
CHECK(readAll(dest) == fresh);
CHECK(!exists(dest + ".rsbanktmp"));
removeQuietly(dest);
}
static void testOpenFailureIsInert() {
@@ -150,7 +200,7 @@ static void testOpenFailureIsInert() {
const std::vector<std::uint8_t> some = patternBytes(8, 1);
CHECK(!writer.appendRaw(some.data(), some.size()));
CHECK(!writer.commit());
CHECK(!fs::exists("pkg_io_no_such_dir"));
CHECK(!exists("pkg_io_no_such_dir"));
}
static void testCommitRenameFailureSelfCleans() {
@@ -158,7 +208,7 @@ static void testCommitRenameFailureSelfCleans() {
// injected commit failure, not a simulated one.
const std::string dest = "pkg_io_dir.rsbank";
std::error_code ec;
fs::create_directory(dest, ec);
fs::create_directory(utf8Path(dest), ec);
CHECK(!ec);
{
PackageFileWriter writer(dest);
@@ -167,9 +217,9 @@ static void testCommitRenameFailureSelfCleans() {
CHECK(writer.appendRaw(some.data(), some.size()));
CHECK(!writer.commit());
}
CHECK(fs::is_directory(dest)); // prior state intact
CHECK(!fs::exists(dest + ".rsbanktmp"));
fs::remove(dest, ec);
CHECK(fs::is_directory(utf8Path(dest))); // prior state intact
CHECK(!exists(dest + ".rsbanktmp"));
fs::remove(utf8Path(dest), ec);
}
static void testReaderEdges() {
@@ -188,38 +238,97 @@ static void testReaderEdges() {
CHECK(reader.readRange(5, 10).empty()); // past the end
CHECK(reader.readRange(10, 1).empty()); // starts at the end
CHECK(reader.readRange(0, 0).empty()); // zero length is failure, one branch
const PayloadBuffer slice = reader.readRange(2, 3);
CHECK(slice.bytes() ==
std::vector<std::uint8_t>(bytes.begin() + 2, bytes.begin() + 5));
CHECK(sameBytes(reader.readRange(2, 3),
std::vector<std::uint8_t>(bytes.begin() + 2, bytes.begin() + 5)));
}
removeQuietly(path);
}
static void testFileStatusSeparatesAbsentFromUnreadable() {
CHECK(fileStatus("pkg_io_no_such_file.bin") == FileStatus::Absent);
const std::string path = "pkg_io_status.bin";
writeScratchFile(path, patternBytes(4, 1));
CHECK(fileStatus(path) == FileStatus::Present);
removeQuietly(path);
// A directory in a file's place is not a readable file — the export message must
// not report it as simply missing.
const std::string dir = "pkg_io_status_dir";
std::error_code ec;
fs::remove(path, ec);
fs::create_directory(utf8Path(dir), ec);
CHECK(fileStatus(dir) == FileStatus::Unreadable);
fs::remove(utf8Path(dir), ec);
}
static void testNonAsciiPathsRoundTripAsUtf8() {
// "café" in UTF-8. Windows decodes a narrow std::filesystem path through the ANSI
// code page, so an unconverted seam lands "café" or fails outright.
const std::string dir = "pkg_io_caf\xC3\xA9_dir";
const std::string name = "caf\xC3\xA9.rsbank";
std::error_code ec;
fs::create_directory(utf8Path(dir), ec);
CHECK(!ec);
const std::string dest = dir + "/" + name;
const std::vector<std::uint8_t> bytes = patternBytes(24, 0x5A);
{
PackageFileWriter writer(dest);
CHECK(writer.ok());
CHECK(writer.appendRaw(bytes.data(), bytes.size()));
CHECK(writer.commit());
}
CHECK(exists(dest));
CHECK(fileStatus(dest) == FileStatus::Present);
CHECK(sameBytes(readFilePayload(dest), bytes));
// The listing must hand the name back in the same encoding it was given.
CHECK(listFolderFileNames(dir) == (std::vector<std::string>{name}));
fs::remove_all(utf8Path(dir), ec);
}
static void testWriteFileExclusiveRefusesAnOccupiedPath() {
const std::string path = "pkg_io_excl.bin";
const std::vector<std::uint8_t> mine = patternBytes(12, 3);
CHECK(writeFileExclusive(path, PayloadBuffer(mine)));
CHECK(readAll(path) == mine);
// The create IS the check: a second call cannot replace the first file's bytes.
CHECK(!writeFileExclusive(path, PayloadBuffer(patternBytes(9, 8))));
CHECK(readAll(path) == mine);
CHECK(!writeFileExclusive("pkg_io_excl_empty.bin", PayloadBuffer{}));
CHECK(!exists("pkg_io_excl_empty.bin"));
removeQuietly(path);
}
static void testListFolderFileNames() {
const std::string dir = "pkg_io_listdir";
std::error_code ec;
fs::create_directory(dir, ec);
fs::create_directory(utf8Path(dir), ec);
writeScratchFile(dir + "/b.bin", patternBytes(2, 1));
writeScratchFile(dir + "/a.bin", patternBytes(2, 2));
fs::create_directory(dir + "/sub", ec);
fs::create_directory(utf8Path(dir + "/sub"), ec);
writeScratchFile(dir + "/sub/c.bin", patternBytes(2, 3));
const std::vector<std::string> names = listFolderFileNames(dir);
CHECK(names == (std::vector<std::string>{"a.bin", "b.bin"})); // sorted, bare, non-recursive
CHECK(listFolderFileNames("pkg_io_no_such_dir").empty());
fs::remove_all(dir, ec);
fs::remove_all(utf8Path(dir), ec);
}
int main() {
testPayloadCounterTracksMovesNotCopies();
testStreamingRoundTripHoldsOnePayload();
testEmptyPayloadIsRefusedAndPoisonsTheWriter();
testAbandonedWriteLeavesNoDestination();
testAbortPreservesPriorContents();
testCommitReplacesAnExistingFile();
testOpenFailureIsInert();
testCommitRenameFailureSelfCleans();
testReaderEdges();
testFileStatusSeparatesAbsentFromUnreadable();
testNonAsciiPathsRoundTripAsUtf8();
testWriteFileExclusiveRefusesAnOccupiedPath();
testListFolderFileNames();
if (g_fail == 0) std::printf("package_io: all tests passed\n");