chore: Reproduce connection poisoning

bindings/sftp/docker-compose.yaml

@@ -9,3 +9,28 @@ services:
     ports:
       - "2222:22"
 
+  sftpgo:
+    image: drakkan/sftpgo:latest
+    container_name: sftpgo
+    ports:
+      - "2224:2022"   # SFTP
+      - "8080:8080"   # Admin UI (optional)
+    environment:
+      # SFTP listener
+      SFTPGO_SFTPD__BINDINGS__0__PORT: 2022
+
+      # Data provider: SQLite (stores users/admins/config)
+      SFTPGO_DATA_PROVIDER__DRIVER: sqlite
+      # SQLite DB path (absolute path is allowed)
+      SFTPGO_DATA_PROVIDER__NAME: /var/lib/sftpgo/sftpgo.db
+
+      # Bootstrap admin user
+      SFTPGO_DEFAULT_ADMIN_USERNAME: admin
+      SFTPGO_DEFAULT_ADMIN_PASSWORD: admin123
+    volumes:
+      # Persist SFTPGo metadata + storage
+      - ./sftpgo-data:/var/lib/sftpgo
+      # Equivalent to ./upload mounted inside the container
+      - ./upload:/var/lib/sftpgo/data/foo/upload
+    restart: unless-stopped
+

bindings/sftp/sftp_integration_test.go

@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"math/rand"
 	"os"
+	"os/exec"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -36,15 +37,19 @@ import (
 
 const (
 	ProxySftp        = "0.0.0.0:2223"
-	ConnectionString = "0.0.0.0:2222"
+	ConnectionString = "0.0.0.0:2224"
 )
 
+var log = logger.NewLogger("sftp-test")
+
 func TestIntegrationCases(t *testing.T) {
-	cleanUp := setupSftp(t)
-	defer cleanUp()
+	//cleanUp := setupSftp(t)
+	//defer cleanUp()
+	log.SetOutputLevel(logger.DebugLevel)
 	time.Sleep(1 * time.Second)
 	t.Run("List operation", testListOperation)
 	t.Run("Create operation", testCreateOperation)
+	t.Run("Poison get", testPoisonGet)
 	t.Run("Reconnections", testReconnect)
 }
 
@@ -80,7 +85,7 @@ func testListOperation(t *testing.T) {
 	m := bindings.Metadata{}
 
 	m.Properties = map[string]string{
-		"rootPath":              "/upload",
+		"rootPath":              "/data/foo/upload",
 		"address":               ProxySftp,
 		"username":              "foo",
 		"password":              "pass",
@@ -301,3 +306,60 @@ func testReconnect(t *testing.T) {
 		assert.InDelta(t, expectedReconnects, currentReconnects, 2.0, "Expected %d reconnections, got %d", expectedReconnects, currentReconnects)
 	})
 }
+
+func testPoisonGet(t *testing.T) {
+	proxy := &sftp.Proxy{
+		ListenAddr:   ProxySftp,
+		UpstreamAddr: ConnectionString,
+	}
+	defer proxy.Close()
+	go proxy.ListenAndServe()
+	c := Sftp{
+		logger: log,
+	}
+	m := bindings.Metadata{}
+	m.Properties = map[string]string{
+		"rootPath":              "/data/foo/upload",
+		"address":               ProxySftp,
+		"username":              "foo",
+		"password":              "pass",
+		"insecureIgnoreHostKey": "true",
+	}
+
+	err := c.Init(t.Context(), m)
+	require.NoError(t, err)
+
+	r, err := c.Invoke(t.Context(), &bindings.InvokeRequest{
+		Operation: bindings.CreateOperation,
+		Data:      []byte("test data 1"),
+		Metadata: map[string]string{
+			"fileName": "test.txt",
+		},
+	})
+	require.NoError(t, err)
+	assert.NotNil(t, r.Data)
+
+	get := func() error {
+		r, err := c.Invoke(t.Context(), &bindings.InvokeRequest{
+			Operation: bindings.GetOperation,
+			Metadata: map[string]string{
+				"fileName": "test.txt",
+			},
+		})
+		if r != nil {
+			log.Infof("Response: %s", r.Data)
+		}
+		return err
+	}
+
+	err = get()
+	require.NoError(t, err)
+
+	require.NoError(t, exec.Command("docker", "exec", "sftpgo", "chmod", "600", "/var/lib/sftpgo/data/foo/upload").Run())
+	err = get()
+	require.Error(t, err)
+
+	require.NoError(t, exec.Command("docker", "exec", "sftpgo", "chmod", "777", "/var/lib/sftpgo/data/foo/upload").Run())
+	err = get()
+	require.NoError(t, err)
+}