spanwright
Version:
CLI tool to generate Cloud Spanner E2E testing framework projects with Go database tools and Playwright browser automation
138 lines • 6.51 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
const vitest_1 = require("vitest");
const validation_1 = require("../validation");
const errors_1 = require("../errors");
(0, vitest_1.describe)('CLI Security Tests', () => {
(0, vitest_1.beforeEach)(() => {
vitest_1.vi.clearAllMocks();
});
(0, vitest_1.afterEach)(() => {
vitest_1.vi.restoreAllMocks();
});
(0, vitest_1.describe)('Project Name Security Validation', () => {
(0, vitest_1.it)('should prevent path traversal attacks in project names', () => {
const maliciousNames = [
'../../../etc/passwd',
'..\\..\\..\\Windows\\System32',
'project../../../etc',
'../project',
'project..',
'..project..',
'safe/../unsafe',
];
maliciousNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
(0, vitest_1.it)('should prevent null byte injection in project names', () => {
const maliciousNames = [
'project\0.js',
'project\0/../../../etc/passwd',
'safe\0unsafe',
'\0project',
'project\0',
];
maliciousNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
(0, vitest_1.it)('should prevent absolute path injection in project names', () => {
const maliciousNames = [
'/etc/passwd',
'/root/.ssh/id_rsa',
'C:Windows\\System32',
'D:temp\\evil',
'/tmp/evil',
'\\\\server\\share\\evil',
];
maliciousNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
(0, vitest_1.it)('should prevent hidden file/directory creation', () => {
const hiddenNames = ['.hidden-project', '.secret', '.ssh', '.config'];
hiddenNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
(0, vitest_1.it)('should allow safe project names', () => {
const safeNames = [
'my-project',
'project123',
'Project_Name',
'test-project-name',
'myproject',
'test_project',
];
safeNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).not.toThrow();
});
});
});
(0, vitest_1.describe)('Input Sanitization', () => {
(0, vitest_1.it)('should reject Unicode characters for security', () => {
const unicodeNames = ['项目名称', 'プロジェクト', 'проект', 'مشروع', '📁project📄'];
unicodeNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
(0, vitest_1.it)('should handle empty and whitespace-only names', () => {
const invalidNames = ['', ' ', '\t\n\r'];
invalidNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
});
(0, vitest_1.describe)('Edge Cases and Attack Vectors', () => {
(0, vitest_1.it)('should handle mixed encoding attacks', () => {
const encodedNames = [
'%2e%2e%2f', // URL encoded ../ - contains % which is not allowed
'unicode.encoded', // Contains dot which is not allowed
];
encodedNames.forEach(name => {
// These should be rejected due to special characters
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
// These contain actual dangerous characters that should be detected
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)('..%2f')).toThrow(errors_1.ValidationError);
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)('%2e%2e\\\\')).toThrow(errors_1.ValidationError); // Contains \\
});
(0, vitest_1.it)('should handle case sensitivity correctly', () => {
const caseVariations = [
'PROJECT',
'Project',
'project',
'PrOjEcT',
'MY-PROJECT',
'my-project',
];
caseVariations.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).not.toThrow();
});
});
(0, vitest_1.it)('should reject special characters for security', () => {
const specialNames = [
'project@company.com',
'project+version',
'project-v1.0', // Contains dot which is not allowed
'project(1)',
'project[test]',
'project{dev}',
];
specialNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
// These should be allowed (only letters, numbers, hyphens, underscores)
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)('project_final')).not.toThrow();
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)('project-v1')).not.toThrow();
});
(0, vitest_1.it)('should reject dangerous pattern combinations', () => {
const dangerousNames = ['project..evil', 'test/../hack', 'normal\0inject', '.hidden/../etc'];
dangerousNames.forEach(name => {
(0, vitest_1.expect)(() => (0, validation_1.validateProjectName)(name)).toThrow(errors_1.ValidationError);
});
});
});
});
//# sourceMappingURL=cli-security.test.js.map