70 lines
2.0 KiB
TypeScript
70 lines
2.0 KiB
TypeScript
import path from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
import { withEnv } from "../test-utils/env.js";
|
|
import {
|
|
buildTrustedSafeBinDirs,
|
|
getTrustedSafeBinDirs,
|
|
isTrustedSafeBinPath,
|
|
} from "./exec-safe-bin-trust.js";
|
|
|
|
describe("exec safe bin trust", () => {
|
|
it("builds trusted dirs from defaults and injected PATH", () => {
|
|
const dirs = buildTrustedSafeBinDirs({
|
|
pathEnv: "/custom/bin:/alt/bin:/custom/bin",
|
|
delimiter: ":",
|
|
baseDirs: ["/usr/bin"],
|
|
});
|
|
|
|
expect(dirs.has(path.resolve("/usr/bin"))).toBe(true);
|
|
expect(dirs.has(path.resolve("/custom/bin"))).toBe(true);
|
|
expect(dirs.has(path.resolve("/alt/bin"))).toBe(true);
|
|
expect(dirs.size).toBe(3);
|
|
});
|
|
|
|
it("memoizes trusted dirs per PATH snapshot", () => {
|
|
const a = getTrustedSafeBinDirs({
|
|
pathEnv: "/first/bin",
|
|
delimiter: ":",
|
|
refresh: true,
|
|
});
|
|
const b = getTrustedSafeBinDirs({
|
|
pathEnv: "/first/bin",
|
|
delimiter: ":",
|
|
});
|
|
const c = getTrustedSafeBinDirs({
|
|
pathEnv: "/second/bin",
|
|
delimiter: ":",
|
|
});
|
|
|
|
expect(a).toBe(b);
|
|
expect(c).not.toBe(b);
|
|
});
|
|
|
|
it("validates resolved paths using injected trusted dirs", () => {
|
|
const trusted = new Set([path.resolve("/usr/bin")]);
|
|
expect(
|
|
isTrustedSafeBinPath({
|
|
resolvedPath: "/usr/bin/jq",
|
|
trustedDirs: trusted,
|
|
}),
|
|
).toBe(true);
|
|
expect(
|
|
isTrustedSafeBinPath({
|
|
resolvedPath: "/tmp/evil/jq",
|
|
trustedDirs: trusted,
|
|
}),
|
|
).toBe(false);
|
|
});
|
|
|
|
it("uses startup PATH snapshot when pathEnv is omitted", () => {
|
|
const injected = `/tmp/openclaw-path-injected-${Date.now()}`;
|
|
const initial = getTrustedSafeBinDirs({ refresh: true });
|
|
|
|
withEnv({ PATH: `${injected}${path.delimiter}${process.env.PATH ?? ""}` }, () => {
|
|
const refreshed = getTrustedSafeBinDirs({ refresh: true });
|
|
expect(refreshed.has(path.resolve(injected))).toBe(false);
|
|
expect([...refreshed].toSorted()).toEqual([...initial].toSorted());
|
|
});
|
|
});
|
|
});
|