Skip to content

Tests for external file path validation - #39

Open
Pyolar wants to merge 3 commits into
FirebirdSQL:masterfrom
Pyolar:fix/external-file-path-validation
Open

Tests for external file path validation#39
Pyolar wants to merge 3 commits into
FirebirdSQL:masterfrom
Pyolar:fix/external-file-path-validation

Conversation

@Pyolar

@Pyolar Pyolar commented Aug 8, 2026

Copy link
Copy Markdown

Companion tests for the firebird PR that validates external table file paths at metadata load time.

The tests are self-contained: they use dedicated databases.conf aliases with ExternalFileAccess restricted to the database directory, and derive the file paths from the actual database location at runtime. No external configuration is required and nothing is skipped.

  • test_external_file_access_denied: CREATE TABLE with a path outside the restricted list must fail at DDL time with SQLSTATE 28000.
  • test_external_file_allowed_dir: external table inside the allowed directory still works (regression guard).

Verified locally: 2 passed with the fix, denied test fails without it.

Corresponding fix: FirebirdSQL/firebird#9121

Two tests covering the DDL-time check of external table file paths
against the ExternalFileAccess policy:

- test_external_file_access_denied: CREATE TABLE with a path outside
  the restricted directory list must fail with SQLSTATE 28000 at
  CREATE TABLE time.
- test_external_file_allowed_dir: a table inside the allowed directory
  still works, guarding against regressions.

Both tests skip when ExternalFileAccess is not configured as a
restricted list.
Pyolar added 2 commits August 8, 2026 23:09
The tests previously relied on the ExternalFileAccess setting of the
test environment and skipped when it was not a restricted list, which
made them ineffective in the default QA configuration.

Add dedicated databases.conf aliases with ExternalFileAccess restricted
to the database directory, and derive the denied/allowed file paths
from the actual database location at runtime.  The tests no longer
skip; a missing fix now fails them instead.

Verified: 2 passed with the fix, 1 failed without it.
Drop the explicit user, password, async_write and do_not_drop
parameters.  The QA harness supplies credentials from the server
configuration, and the database is removed by the fixture teardown
as usual, so no leftover database is left between runs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant