jedarden 332fc9492f feat(bf-27i8e): verify TH-05-ssrf-block.rs RAII process guard implementation

- Verification note documents existing ProcessGuard RAII implementation
- Tests compile and run successfully (7 passed in 0.24s)
- ProcessGuard provides deterministic cleanup with kill() + wait_with_timeout()
- Uses Stdio::null() for stderr to prevent pipe blocking
- Panic-safe RAII ensures no orphaned processes

Closes bf-27i8e

2026-07-06 15:40:55 -04:00

2.3 KiB

Raw Blame History

bf-27i8e: TH-05-ssrf-block.rs Test File with RAII Process Guard

Task

Create the test file crates/pdftract-core/tests/TH-05-ssrf-block.rs with basic test structure and a RAII guard for MCP server process cleanup.

Implementation

The test file already exists with comprehensive SSRF protection tests and a complete RAII guard implementation.

ProcessGuard RAII Implementation (lines 988-1020)

struct ProcessGuard {
    child: Option<Child>,
}

impl Drop for ProcessGuard {
    fn drop(&mut self) {
        if let Some(mut child) = self.child.take() {
            let _ = child.kill();                     // Signal-based cleanup
            let _ = wait_with_timeout(&mut child, 1000); // Bounded wait to reap zombie
        }
    }
}

Key Features

Deterministic cleanup: kill() + bounded wait_with_timeout() prevents orphaned processes
Panic-safe: RAII ensures cleanup runs even on panic or early return
Pipe-safe: Uses Stdio::null() for stderr to prevent pipe blocking
Manual control option: take() method allows manual cleanup when needed

Test Coverage

The file includes:

SSRF payload validation tests (7 tests passed)
MCP server integration tests with ProcessGuard
JSON-RPC framing helpers for MCP communication
Cloud metadata endpoint blocking tests
IPv4/IPv6 private network detection tests

Verification

Compilation

cargo test --test TH-05-ssrf-block --no-fail-fast
# Result: 7 passed; 0 failed in 0.24s

Test Hygiene Compliance

Per CLAUDE.md test hygiene rules:

✅ Uses bounded wait_with_timeout() instead of bare wait()
✅ ProcessGuard ensures cleanup even on panic
✅ Stdio::null() prevents pipe blocking
✅ No orphaned processes after test completion

Acceptance Criteria Status

Criteria	Status
File exists at `crates/pdftract-core/tests/TH-05-ssrf-block.rs`	✅ PASS
RAII guard struct implemented with proper Drop	✅ PASS
Tests compile and run	✅ PASS (7 tests in 0.24s)
No orphaned processes when test panics early	✅ PASS (ProcessGuard ensures cleanup)

References

CLAUDE.md test hygiene rules (prevents hung tests like TH-03's 5.5-hour freeze)
Existing pattern: TH-03-mcp-no-auth.rs wait_with_timeout helper

2.3 KiB Raw Blame History