mirror of https://github.com/openclaw/openclaw.git
82 lines
2.8 KiB
TypeScript
82 lines
2.8 KiB
TypeScript
import { describe, expect, test } from "vitest";
|
|
import { resolveExecWrapperTrustPlan } from "./exec-wrapper-trust-plan.js";
|
|
|
|
describe("resolveExecWrapperTrustPlan", () => {
|
|
test.each([
|
|
{
|
|
name: "unwraps dispatch wrappers and shell multiplexers into one trust plan",
|
|
enabled: process.platform !== "win32",
|
|
argv: ["/usr/bin/time", "-p", "busybox", "sh", "-lc", "echo hi"],
|
|
expected: {
|
|
argv: ["sh", "-lc", "echo hi"],
|
|
policyArgv: ["busybox", "sh", "-lc", "echo hi"],
|
|
wrapperChain: ["time", "busybox"],
|
|
policyBlocked: false,
|
|
shellWrapperExecutable: true,
|
|
shellInlineCommand: "echo hi",
|
|
},
|
|
},
|
|
{
|
|
name: "unwraps script wrappers before evaluating nested shell payloads",
|
|
enabled: process.platform === "darwin" || process.platform === "freebsd",
|
|
argv: ["/usr/bin/script", "-q", "/dev/null", "sh", "-lc", "echo hi"],
|
|
expected: {
|
|
argv: ["sh", "-lc", "echo hi"],
|
|
policyArgv: ["sh", "-lc", "echo hi"],
|
|
wrapperChain: ["script"],
|
|
policyBlocked: false,
|
|
shellWrapperExecutable: true,
|
|
shellInlineCommand: "echo hi",
|
|
},
|
|
},
|
|
{
|
|
name: "fails closed for unsupported shell multiplexer applets",
|
|
enabled: true,
|
|
argv: ["busybox", "sed", "-n", "1p"],
|
|
expected: {
|
|
argv: ["busybox", "sed", "-n", "1p"],
|
|
policyArgv: ["busybox", "sed", "-n", "1p"],
|
|
wrapperChain: [],
|
|
policyBlocked: true,
|
|
blockedWrapper: "busybox",
|
|
shellWrapperExecutable: false,
|
|
shellInlineCommand: null,
|
|
},
|
|
},
|
|
{
|
|
name: "fails closed when outer-wrapper depth overflows",
|
|
enabled: true,
|
|
argv: ["nohup", "timeout", "5s", "busybox", "sh", "-lc", "echo hi"],
|
|
depth: 2,
|
|
expected: {
|
|
argv: ["busybox", "sh", "-lc", "echo hi"],
|
|
policyArgv: ["busybox", "sh", "-lc", "echo hi"],
|
|
wrapperChain: ["nohup", "timeout"],
|
|
policyBlocked: true,
|
|
blockedWrapper: "busybox",
|
|
shellWrapperExecutable: false,
|
|
shellInlineCommand: null,
|
|
},
|
|
},
|
|
{
|
|
name: "keeps the blocked dispatch argv as the policy target after transparent unwraps",
|
|
enabled: process.platform !== "win32",
|
|
argv: ["/usr/bin/time", "-p", "/usr/bin/env", "FOO=bar", "sh", "-lc", "echo hi"],
|
|
expected: {
|
|
argv: ["/usr/bin/env", "FOO=bar", "sh", "-lc", "echo hi"],
|
|
policyArgv: ["/usr/bin/env", "FOO=bar", "sh", "-lc", "echo hi"],
|
|
wrapperChain: [],
|
|
policyBlocked: true,
|
|
blockedWrapper: "env",
|
|
shellWrapperExecutable: false,
|
|
shellInlineCommand: null,
|
|
},
|
|
},
|
|
])("$name", ({ enabled, argv, depth, expected }) => {
|
|
if (!enabled) {
|
|
return;
|
|
}
|
|
expect(resolveExecWrapperTrustPlan(argv, depth)).toEqual(expected);
|
|
});
|
|
});
|