fix: preserve recovery helper traversal

2026-08-16 03:30:03 +08:00
parent 29a7295667
commit 9f31de7b4a
5 changed files with 9 additions and 7 deletions
@@ -1091,6 +1091,7 @@ test("production recovery workflow creates a verified encrypted off-site artifac
  assert.match(runner, /sudo -n docker run --rm --pull never --network none --read-only --user 0:0/);
  assert.match(runner, /--cap-drop ALL --cap-add CHOWN --security-opt no-new-privileges/);
  assert.match(runner, /--entrypoint chown "\$ownership_image"/);
+  assert.match(runner, /ownership_targets=\(\)[\s\S]*ownership_targets\+=\("\$lock_file"\)[\s\S]*ownership_targets\+=\("\$state_directory" "\$backup_directory"\)/);
  assert.match(runner, /"\$deployment_uid:\$deployment_gid" "\$\{ownership_targets\[@\]\}"/);
  assert.match(runner, /production mutation lock is unsafe/);
  assert.doesNotMatch(runner, /rm -f[^\n]*mutation\.lock|chown -R/);