* Added a test that make sure that users cannot register

  specially-crafted derivations that produce output paths belonging to
  other derivations.  This could be used to inject malware into the
  store.

1 files changed, 23 insertions, 0 deletions

diff --git a/tests/secure-drv-outputs.nix b/tests/secure-drv-outputs.nix
new file mode 100644
index 000000000000..da4012eb41c0
--- /dev/null
+++ b/tests/secure-drv-outputs.nix
@@ -0,0 +1,23 @@
+with import ./config.nix;
+
+{
+
+  good = mkDerivation {
+    name = "good";
+    builder = builtins.toFile "builder"
+      ''
+        mkdir $out
+        touch $out/good
+      '';
+  };
+
+  bad = mkDerivation {
+    name = "good";
+    builder = builtins.toFile "builder"
+      ''
+        mkdir $out
+        touch $out/bad
+      '';
+  };
+
+}