Add load_restrictor flag.

pkg/target/baseandoverlaysmall_test.go

@@ -17,7 +17,11 @@ limitations under the License.
 package target_test
 
 import (
+	"strings"
 	"testing"
+
+	"sigs.k8s.io/kustomize/k8sdeps/kv/plugin"
+	"sigs.k8s.io/kustomize/pkg/loader"
 )
 
 func writeSmallBase(th *KustTestHarness) {
@@ -181,8 +185,42 @@ spec:
 `)
 }
 
+func TestSharedPatchDisAllowed(t *testing.T) {
+	th := NewKustTestHarnessFull(
+		t, "/app/overlay",
+		loader.RestrictionRootOnly, plugin.DefaultPluginConfig())
+	writeSmallBase(th)
+	th.writeK("/app/overlay", `
+commonLabels:
+  env: prod
+bases:
+- ../base
+patchesStrategicMerge:
+- ../shared/deployment-patch.yaml
+`)
+	th.writeF("/app/shared/deployment-patch.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: myDeployment
+spec:
+  replicas: 1000
+`)
+	_, err := th.makeKustTarget().MakeCustomizedResMap()
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if !strings.Contains(
+		err.Error(),
+		"security; file '/app/shared/deployment-patch.yaml' is not in or below '/app/overlay'") {
+		t.Fatalf("unexpected error: %s", err)
+	}
+}
+
 func TestSharedPatchAllowed(t *testing.T) {
-	th := NewKustTestHarness(t, "/app/overlay")
+	th := NewKustTestHarnessFull(
+		t, "/app/overlay",
+		loader.RestrictionNone, plugin.DefaultPluginConfig())
 	writeSmallBase(th)
 	th.writeK("/app/overlay", `
 commonLabels:

pkg/target/kusttestharness_test.go

@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/kustomize/k8sdeps/kv/plugin"
 	"sigs.k8s.io/kustomize/k8sdeps/transformer"
 	"sigs.k8s.io/kustomize/pkg/internal/loadertest"
+	"sigs.k8s.io/kustomize/pkg/loader"
 	"sigs.k8s.io/kustomize/pkg/pgmconfig"
 	"sigs.k8s.io/kustomize/pkg/resmap"
 	"sigs.k8s.io/kustomize/pkg/resource"
@@ -51,12 +52,18 @@ func NewKustTestHarness(t *testing.T, path string) *KustTestHarness {
 func NewKustTestHarnessWithPluginConfig(
 	t *testing.T, path string,
 	pc *types.PluginConfig) *KustTestHarness {
+	return NewKustTestHarnessFull(t, path, loader.RestrictionRootOnly, pc)
+}
+
+func NewKustTestHarnessFull(
+	t *testing.T, path string,
+	lr loader.LoadRestrictorFunc, pc *types.PluginConfig) *KustTestHarness {
 	return &KustTestHarness{
 		t: t,
 		rf: resmap.NewFactory(resource.NewFactory(
 			kunstruct.NewKunstructuredFactoryWithGeneratorArgs(
 				&types.GeneratorMetaArgs{PluginConfig: pc}))),
-		ldr: loadertest.NewFakeLoader(path),
+		ldr: loadertest.NewFakeLoaderWithRestrictor(lr, path),
 		pc:  pc}
 }