volumes: test host path validation

src/test/volumes-test.js

@@ -9,6 +9,7 @@
 const BoxError = require('../boxerror.js'),
     common = require('./common.js'),
     expect = require('expect.js'),
+    paths = require('../paths.js'),
     safe = require('safetydance'),
     volumes = require('../volumes.js');
 
@@ -73,4 +74,26 @@ describe('Volumes', function () {
     it('can del volume', async function () {
         await volumes.del(volume, auditSource);
     });
+
+    const badPaths = [
+        '/opt/data/../bar', // not normalized
+        'opt/data/bar', // not absolute
+        '/', // root
+        '/mnt', // top level itself is reserved
+        '/usr/bin', // reserved
+        paths.VOLUMES_MOUNT_DIR, // reserved
+        paths.VOLUMES_MOUNT_DIR + '/', // also reserved
+        paths.VOLUMES_MOUNT_DIR + '/something', // also reserved
+        '/media/cloudron-test-music/root', // realpath won't match
+        '/media/cloudron-test-music/root/', // realpath won't match
+        '/media/cloudron-test-music/file', // need directory
+        '/media/cloudron-test-music/randompath', // need directory
+    ];
+
+    for (const p of badPaths) {
+        it(`validateHostPath - ${p}`, function () {
+            const error = volumes._validateHostPath(p);
+            expect(error.reason).to.be(BoxError.BAD_FIELD);
+        });
+    }
 });