|
| 1 | +package tool |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "os" |
| 6 | + "path/filepath" |
| 7 | + "strings" |
| 8 | + "testing" |
| 9 | +) |
| 10 | + |
| 11 | +// These tests exercise the file tools' use of the sensitive-path policy, so |
| 12 | +// they live in package tool (the policy itself is tested in toolsafety). |
| 13 | + |
| 14 | +func TestFileToolsBlockFluxProviderConfig(t *testing.T) { |
| 15 | + fluxDir := filepath.Join(t.TempDir(), "flux") |
| 16 | + t.Setenv("FLUX_CONFIG_DIR", fluxDir) |
| 17 | + providerPath := filepath.Join(fluxDir, "provider.json") |
| 18 | + |
| 19 | + readInput, _ := json.Marshal(map[string]string{"path": providerPath}) |
| 20 | + editInput, _ := json.Marshal(map[string]string{ |
| 21 | + "path": providerPath, "old_str": "old", "new_str": "new", |
| 22 | + }) |
| 23 | + writeInput, _ := json.Marshal(map[string]string{ |
| 24 | + "path": providerPath, "content": "safe routing metadata", |
| 25 | + }) |
| 26 | + tests := []struct { |
| 27 | + name string |
| 28 | + run func() error |
| 29 | + }{ |
| 30 | + {name: "Read", run: func() error { |
| 31 | + _, err := (FileReadTool{}).Execute(testCtx(), readInput) |
| 32 | + return err |
| 33 | + }}, |
| 34 | + {name: "Edit", run: func() error { |
| 35 | + _, err := (FileEditTool{}).Execute(testCtx(), editInput) |
| 36 | + return err |
| 37 | + }}, |
| 38 | + {name: "Write", run: func() error { |
| 39 | + _, err := (FileWriteTool{}).Execute(testCtx(), writeInput) |
| 40 | + return err |
| 41 | + }}, |
| 42 | + } |
| 43 | + |
| 44 | + for _, tt := range tests { |
| 45 | + t.Run(tt.name, func(t *testing.T) { |
| 46 | + err := tt.run() |
| 47 | + if err == nil || !strings.Contains(err.Error(), "blocked") { |
| 48 | + t.Fatalf("%s error = %v, want sensitive-path block", tt.name, err) |
| 49 | + } |
| 50 | + }) |
| 51 | + } |
| 52 | +} |
| 53 | + |
| 54 | +// TestFileRead_BlocksSymlinkToSensitiveFile verifies the read tool resolves |
| 55 | +// symlinks before opening (M13): reading through a symlink that points at a |
| 56 | +// sensitive target is blocked, while a symlink to an ordinary file works. |
| 57 | +func TestFileRead_BlocksSymlinkToSensitiveFile(t *testing.T) { |
| 58 | + fluxDir := filepath.Join(t.TempDir(), "flux") |
| 59 | + if err := os.MkdirAll(fluxDir, 0o755); err != nil { |
| 60 | + t.Fatal(err) |
| 61 | + } |
| 62 | + t.Setenv("FLUX_CONFIG_DIR", fluxDir) |
| 63 | + providerPath := filepath.Join(fluxDir, "provider.json") |
| 64 | + if err := os.WriteFile(providerPath, []byte(`{"key":"x"}`), 0o600); err != nil { |
| 65 | + t.Fatal(err) |
| 66 | + } |
| 67 | + |
| 68 | + workDir := t.TempDir() |
| 69 | + link := filepath.Join(workDir, "readme.md") |
| 70 | + if err := os.Symlink(providerPath, link); err != nil { |
| 71 | + t.Fatal(err) |
| 72 | + } |
| 73 | + in, _ := json.Marshal(map[string]string{"path": link}) |
| 74 | + _, err := (FileReadTool{}).Execute(testCtx(), in) |
| 75 | + if err == nil || !strings.Contains(err.Error(), "blocked") { |
| 76 | + t.Fatalf("expected sensitive-path block for symlinked provider config, got %v", err) |
| 77 | + } |
| 78 | + |
| 79 | + // A symlink to an ordinary file must still read fine. |
| 80 | + plain := filepath.Join(workDir, "plain.txt") |
| 81 | + if err := os.WriteFile(plain, []byte("hello"), 0o600); err != nil { |
| 82 | + t.Fatal(err) |
| 83 | + } |
| 84 | + link2 := filepath.Join(workDir, "link2.txt") |
| 85 | + if err := os.Symlink(plain, link2); err != nil { |
| 86 | + t.Fatal(err) |
| 87 | + } |
| 88 | + in2, _ := json.Marshal(map[string]string{"path": link2}) |
| 89 | + out, err := (FileReadTool{}).Execute(testCtx(), in2) |
| 90 | + if err != nil { |
| 91 | + t.Fatalf("expected symlinked plain file to read, got %v", err) |
| 92 | + } |
| 93 | + if !strings.Contains(out, "hello") { |
| 94 | + t.Fatalf("expected content through symlink, got %q", out) |
| 95 | + } |
| 96 | +} |
| 97 | + |
| 98 | +// TestIsSensitivePath_SecretBasenames verifies the expanded basename blocklist |
| 99 | +// (secrets.txt, .git-credentials, private keys, …) applies anywhere, not just |
| 100 | +// under the home directory. |
| 101 | + |
| 102 | +func TestBashSensitivePathIntegration(t *testing.T) { |
| 103 | + if !IsSuspicious("cat ~/.ssh/id_rsa") { |
| 104 | + t.Error("IsSuspicious should flag reads of SSH private keys") |
| 105 | + } |
| 106 | + if !isHardDeny("cat ~/.aws/credentials") { |
| 107 | + t.Error("isHardDeny should block credential reads when prompts are bypassed") |
| 108 | + } |
| 109 | + if isHardDeny("go build ./...") { |
| 110 | + t.Error("isHardDeny should not block ordinary commands") |
| 111 | + } |
| 112 | +} |
| 113 | + |
| 114 | +func TestCommandReferencesSensitivePath_FluxConfigDir(t *testing.T) { |
| 115 | + fluxDir := filepath.Join(t.TempDir(), "flux config with spaces") |
| 116 | + t.Setenv("FLUX_CONFIG_DIR", fluxDir) |
| 117 | + |
| 118 | + commands := []string{ |
| 119 | + `cat "` + filepath.Join(fluxDir, "provider.json") + `"`, |
| 120 | + `cat "$FLUX_CONFIG_DIR/provider.json"`, |
| 121 | + `cat "${FLUX_CONFIG_DIR}/provider.json"`, |
| 122 | + `cat "${FLUX_CONFIG_DIR%/}/provider.json"`, |
| 123 | + `printf '%s\n' "$FLUX_CONFIG_DIR"`, |
| 124 | + "cat " + strings.ReplaceAll(filepath.Join(fluxDir, "provider.json"), " ", `\ `), |
| 125 | + } |
| 126 | + for _, command := range commands { |
| 127 | + if reason := CommandReferencesSensitivePath(command); reason == "" { |
| 128 | + t.Fatalf("CommandReferencesSensitivePath(%q) = empty, want blocked", command) |
| 129 | + } |
| 130 | + if !IsSuspicious(command) { |
| 131 | + t.Fatalf("IsSuspicious(%q) = false, want Bash prompt", command) |
| 132 | + } |
| 133 | + if !isHardDeny(command) { |
| 134 | + t.Fatalf("isHardDeny(%q) = false, want Bash block", command) |
| 135 | + } |
| 136 | + } |
| 137 | +} |
0 commit comments