From 513b200f5c8c88e01b89c0c930ca238a7e196838 Mon Sep 17 00:00:00 2001
From: RichardDorian <richard.dorian@outlook.com>
Date: Wed, 8 Jul 2026 19:36:29 +0200
Subject: [PATCH] test(storage): add out-of-bounds chown coverage for go code
 and script

---
 plugins/storage/subcommands_test.go | 17 ++++++++++
 tests/unit/storage.bats             | 49 +++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 plugins/storage/subcommands_test.go

diff --git a/plugins/storage/subcommands_test.go b/plugins/storage/subcommands_test.go
new file mode 100644
index 000000000..d0d5bfe4e
--- /dev/null
+++ b/plugins/storage/subcommands_test.go
@@ -0,0 +1,17 @@
+package storage
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega"
+)
+
+func TestResolveChownIDRejectsOutOfBoundsValues(t *testing.T) {
+	RegisterTestingT(t)
+
+	for _, chownFlag := range []string{"-1", "65536", "100000", "231072", "abc", "1.5", ""} {
+		_, err := ResolveChownID(chownFlag)
+		Expect(err).To(HaveOccurred(), "expected %q to be rejected", chownFlag)
+		Expect(err.Error()).To(ContainSubstring("Unsupported chown permissions"))
+	}
+}
diff --git a/tests/unit/storage.bats b/tests/unit/storage.bats
index fd2fab276..3acc757bc 100644
--- a/tests/unit/storage.bats
+++ b/tests/unit/storage.bats
@@ -107,6 +107,38 @@ teardown() {
   assert_output_contains "Setting directory ownership to 32767:32767" 1
 }
 
+@test "(storage) chown-storage-dir rejects out-of-bounds chown values" {
+  run /bin/bash -c "DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir $TEST_APP 65536"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unsupported chown permissions"
+
+  run /bin/bash -c "DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir $TEST_APP 165535"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unsupported chown permissions"
+
+  run /bin/bash -c "DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir $TEST_APP 231072"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unsupported chown permissions"
+
+  run /bin/bash -c "DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir $TEST_APP -1"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Value must be a non-negative integer"
+
+  run /bin/bash -c "DOKKU_LIB_ROOT=$DOKKU_LIB_ROOT $PLUGIN_AVAILABLE_PATH/storage/bin/chown-storage-dir $TEST_APP abc"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Value must be a non-negative integer"
+}
+
 @test "(storage) storage:mount, storage:list, storage:umount" {
   run /bin/bash -c "dokku storage:mount $TEST_APP /tmp/mount:/mount"
   echo "output: $output"
@@ -410,6 +442,23 @@ teardown() {
   assert_success
 }
 
+@test "(storage:create) --chown rejects an out-of-bounds numeric uid" {
+  run /bin/bash -c "dokku storage:create --chown 65536 rdmtest-chown-oob"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unsupported chown permissions"
+
+  run /bin/bash -c "dokku storage:create --chown -1 rdmtest-chown-oob"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "Unsupported chown permissions"
+
+  run /bin/bash -c "dokku storage:list-entries --format json | jq -r '.[].name' | grep '^rdmtest-chown-oob$' || true"
+  assert_output ""
+}
+
 @test "(storage:create) --chown rejects a non-default host path" {
   custom_path="/tmp/rdmtest-chown-custom"
   rm -rf "$custom_path"