32 lines
1.3 KiB
Python
32 lines
1.3 KiB
Python
|
import tempfile
|
||
|
|
import unittest
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
import sys
|
||
|
|
|
||
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
|
||
|
|
from zhulan_code_gate import scan_file, within # noqa: E402
|
||
|
|
|
||
|
|
|
||
|
|
class CodeGateTest(unittest.TestCase):
|
||
|
|
def test_paths_fail_closed(self):
|
||
|
|
self.assertTrue(within("server-tools/zhulan-remote-cell/ui/app.js", ["server-tools/zhulan-remote-cell"]))
|
||
|
|
self.assertFalse(within("server-tools/lake-lamp-authz/server.js", ["server-tools/zhulan-remote-cell"]))
|
||
|
|
|
||
|
|
def test_private_key_is_rejected(self):
|
||
|
|
with tempfile.TemporaryDirectory() as root:
|
||
|
|
workspace = Path(root)
|
||
|
|
target = workspace / "leak.txt"
|
||
|
|
target.write_text("-----BEGIN OPENSSH PRIVATE KEY-----\nnot-real\n", encoding="utf-8")
|
||
|
|
self.assertIn("possible_secret", scan_file(workspace, target, 1024 * 1024))
|
||
|
|
|
||
|
|
def test_symlink_outside_workspace_is_rejected(self):
|
||
|
|
with tempfile.TemporaryDirectory() as root, tempfile.TemporaryDirectory() as outside:
|
||
|
|
workspace = Path(root)
|
||
|
|
target = workspace / "outside-link"
|
||
|
|
target.symlink_to(Path(outside) / "secret")
|
||
|
|
self.assertIn("symlink_outside_workspace", scan_file(workspace, target, 1024 * 1024))
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|