fix(api): refuse peer cache files that name types other than datetime

The server and the client both check a forwarded cache file before they write it, because Cacher decodes it with jsonpickle. The session-create cache write now runs off the event loop.

tests/remote/unit/test_cache_payload_safety.py

@@ -0,0 +1,74 @@
+import base64
+import datetime as dt
+import logging
+import zlib
+from types import SimpleNamespace
+
+import pytest
+
+from unshackle.core.api import handlers
+from unshackle.core.api.sanitize import safe_cache_payload
+from unshackle.core.cacher import Cacher
+from unshackle.core.config import config
+from unshackle.core.remote_service import RemoteService
+
+pytestmark = pytest.mark.unit
+
+TAG = "TESTSVC"
+
+
+def b64z(text: str) -> str:
+    return base64.b64encode(zlib.compress(text.encode())).decode("ascii")
+
+
+@pytest.mark.parametrize("text", ['{"a": [1, "b", null]}', '"token"'])
+def test_plain_json_is_safe(text) -> None:
+    assert safe_cache_payload(text)
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        "not json",
+        '{"py/object": "collections.OrderedDict"}',
+        '{"py/type": "builtins.dict"}',
+        '{"py/function": "builtins.print"}',
+        '{"py/repr": "builtins/1"}',
+        '{"py/reduce": [{"py/function": "builtins.print"}, {"py/tuple": ["x"]}]}',
+        '{"py/object": "datetime.datetime", "__reduce__": [{"py/type": "collections.OrderedDict"}, []]}',
+        '{"py/object": "datetime.datetime", "py/state": {}}',
+        "[" * 100000 + "]" * 100000,
+    ],
+)
+def test_unsafe_payload_is_refused(text) -> None:
+    assert safe_cache_payload(text) is False
+
+
+def save_returned(cache_map: dict) -> None:
+    RemoteService.save_returned_cache(SimpleNamespace(service_tag=TAG, log=logging.getLogger("test")), cache_map)
+
+
+@pytest.mark.parametrize(
+    "write", [lambda m: handlers.write_client_cache(m, TAG), save_returned], ids=["server", "client"]
+)
+def test_writer_skips_unsafe_entry(tmp_path, monkeypatch, write) -> None:
+    monkeypatch.setattr(config.directories, "cache", tmp_path)
+    write({"good": b64z('{"a": 1}'), "bad": b64z('{"py/function": "builtins.print"}')})
+    assert (tmp_path / TAG / "good.json").exists()
+    assert not (tmp_path / TAG / "bad.json").exists()
+
+
+@pytest.mark.parametrize(
+    "expiration",
+    [None, dt.datetime(2030, 1, 1, 12, 0, 0), dt.datetime(2030, 1, 1, 12, 0, 0, tzinfo=dt.timezone.utc)],
+    ids=["none", "naive", "aware"],
+)
+def test_real_cacher_file_round_trips(tmp_path, monkeypatch, expiration) -> None:
+    monkeypatch.setattr(config.directories, "cache", tmp_path / "src")
+    cache = Cacher(TAG, "tok")
+    cache.set({"token": "abc", "n": [1, 2]}, expiration=expiration)
+    text = cache.path.read_text(encoding="utf8")
+
+    monkeypatch.setattr(config.directories, "cache", tmp_path / "dst")
+    save_returned({"tok": b64z(text)})
+    assert Cacher(TAG).get("tok").data == {"token": "abc", "n": [1, 2]}

tests/remote/unit/test_remote_service_helpers.py

@@ -395,20 +395,20 @@ def test_save_returned_cache_writes_nested_keys_and_rejects_escapes(tmp_path, mo
     RemoteService.save_returned_cache(
         stub,
         {
-            "tokens": blob("flat"),
-            "session_web/abc": blob("nested"),
-            "session_web\\def": blob("windows"),
-            "MSL/keys.v2": blob("dotted"),
-            "../escape": blob("bad"),
-            "/abs": blob("bad"),
-            "C:/x": blob("bad"),
+            "tokens": blob('"flat"'),
+            "session_web/abc": blob('"nested"'),
+            "session_web\\def": blob('"windows"'),
+            "MSL/keys.v2": blob('"dotted"'),
+            "../escape": blob('"bad"'),
+            "/abs": blob('"bad"'),
+            "C:/x": blob('"bad"'),
         },
     )
 
-    assert (tmp_path / tag / "tokens.json").read_text() == "flat"
-    assert (tmp_path / tag / "session_web" / "abc.json").read_text() == "nested"
-    assert (tmp_path / tag / "session_web" / "def.json").read_text() == "windows"
-    assert (tmp_path / tag / "MSL" / "keys.v2.json").read_text() == "dotted"
+    assert (tmp_path / tag / "tokens.json").read_text() == '"flat"'
+    assert (tmp_path / tag / "session_web" / "abc.json").read_text() == '"nested"'
+    assert (tmp_path / tag / "session_web" / "def.json").read_text() == '"windows"'
+    assert (tmp_path / tag / "MSL" / "keys.v2.json").read_text() == '"dotted"'
     assert not (tmp_path / "escape.json").exists()
     written = sorted(p.relative_to(tmp_path).as_posix() for p in tmp_path.rglob("*.json"))
     assert written == [
@@ -433,7 +433,7 @@ def test_save_returned_cache_drops_other_profiles_files(tmp_path, monkeypatch) -
     monkeypatch.setattr(config.directories, "cache", tmp_path)
     monkeypatch.setattr(config, "credentials", {tag: {"default": "a@example.com:pw", "work": "b@example.com:pw"}})
     stub = SimpleNamespace(service_tag=tag, log=logging.getLogger("test"))
-    blob = base64.b64encode(zlib.compress(b"x")).decode("ascii")
+    blob = base64.b64encode(zlib.compress(b'"x"')).decode("ascii")
 
     RemoteService.save_returned_cache(stub, {"tokens_work": blob, "tokens_default": blob, "tokens": blob}, "work")
 
@@ -560,12 +560,12 @@ def test_session_create_writes_nested_cache_and_skips_colliding_keys(tmp_path, m
     )
     monkeypatch.setattr("unshackle.core.api.session_store.get_session_store", lambda: (_ for _ in ()).throw(Stop()))
 
-    cache = {"x": blob("flat"), "x.json/y": blob("collides"), "MSL/keys.v2": blob("dotted")}
+    cache = {"x": blob('"flat"'), "x.json/y": blob('"collides"'), "MSL/keys.v2": blob('"dotted"')}
     response = asyncio.run(handlers.session_create_handler({"service": "TESTSVC", "title_id": "t", "cache": cache}))
     assert response.status == 500  # the Stop stand-in fired after the cache write
 
     written = {p.name: p.read_text() for p in tmp_path.rglob("*.json") if p.is_file()}
-    assert written == {"x.json": "flat", "keys.v2.json": "dotted"}
+    assert written == {"x.json": '"flat"', "keys.v2.json": '"dotted"'}
 
 
 class _SentCreate(Exception):