mirror of https://github.com/openclaw/openclaw.git
85 lines
2.8 KiB
TypeScript
85 lines
2.8 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import type { OpenClawConfig } from "../config/config.js";
|
|
import {
|
|
collectAttackSurfaceSummaryFindings,
|
|
collectSmallModelRiskFindings,
|
|
} from "./audit-extra.sync.js";
|
|
import { safeEqualSecret } from "./secret-equal.js";
|
|
|
|
describe("collectAttackSurfaceSummaryFindings", () => {
|
|
it.each([
|
|
{
|
|
name: "distinguishes external webhooks from internal hooks when only internal hooks are enabled",
|
|
cfg: {
|
|
hooks: { internal: { enabled: true } },
|
|
} satisfies OpenClawConfig,
|
|
expectedDetail: ["hooks.webhooks: disabled", "hooks.internal: enabled"],
|
|
},
|
|
{
|
|
name: "reports both hook systems as enabled when both are configured",
|
|
cfg: {
|
|
hooks: { enabled: true, internal: { enabled: true } },
|
|
} satisfies OpenClawConfig,
|
|
expectedDetail: ["hooks.webhooks: enabled", "hooks.internal: enabled"],
|
|
},
|
|
{
|
|
name: "reports internal hooks as enabled by default and webhooks as disabled when neither is configured",
|
|
cfg: {} satisfies OpenClawConfig,
|
|
expectedDetail: ["hooks.webhooks: disabled", "hooks.internal: enabled"],
|
|
},
|
|
{
|
|
name: "reports internal hooks as disabled when explicitly set to false",
|
|
cfg: {
|
|
hooks: { internal: { enabled: false } },
|
|
} satisfies OpenClawConfig,
|
|
expectedDetail: ["hooks.internal: disabled"],
|
|
},
|
|
])("$name", ({ cfg, expectedDetail }) => {
|
|
const [finding] = collectAttackSurfaceSummaryFindings(cfg);
|
|
expect(finding.checkId).toBe("summary.attack_surface");
|
|
for (const snippet of expectedDetail) {
|
|
expect(finding.detail).toContain(snippet);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("safeEqualSecret", () => {
|
|
it.each([
|
|
["secret-token", "secret-token", true],
|
|
["secret-token", "secret-tokEn", false],
|
|
["short", "much-longer", false],
|
|
[undefined, "secret", false],
|
|
["secret", undefined, false],
|
|
[null, "secret", false],
|
|
] as const)("compares %o and %o", (left, right, expected) => {
|
|
expect(safeEqualSecret(left, right)).toBe(expected);
|
|
});
|
|
});
|
|
|
|
describe("collectSmallModelRiskFindings", () => {
|
|
const baseCfg = {
|
|
agents: { defaults: { model: { primary: "ollama/mistral-8b" } } },
|
|
browser: { enabled: false },
|
|
tools: { web: { fetch: { enabled: false } } },
|
|
} satisfies OpenClawConfig;
|
|
|
|
it.each([
|
|
{
|
|
name: "small model without sandbox all stays critical even when browser/web tools are off",
|
|
cfg: baseCfg,
|
|
env: {},
|
|
},
|
|
])("$name", ({ cfg, env }) => {
|
|
const [finding] = collectSmallModelRiskFindings({
|
|
cfg,
|
|
env,
|
|
});
|
|
|
|
expect(finding?.checkId).toBe("models.small_params");
|
|
expect(finding?.severity).toBe("critical");
|
|
expect(finding?.detail).toContain("ollama/mistral-8b");
|
|
expect(finding?.detail).toContain("web=[off]");
|
|
expect(finding?.detail).toContain("No web/browser tools detected");
|
|
});
|
|
});
|