7 lines
1.1 KiB
TypeScript
7 lines
1.1 KiB
TypeScript
import { test } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { createSecurityPreflight } from '../src/facade/securityPreflight'
|
|
|
|
test('security preflight accepts bounded paths, archives, XML and read permissions', () => { const security = createSecurityPreflight(); assert.equal(security.path('projects/model.FCStd'), 'projects/model.FCStd'); security.archive([{ path: 'Document.xml', compressedBytes: 100, uncompressedBytes: 500 }]); security.xml('<Document><Object id="box"/></Document>'); security.permissions(['geometry.read']); assert.equal(security.report().pass, true) })
|
|
test('security preflight rejects traversal, bombs, XML entities and privileged permissions', () => { const security = createSecurityPreflight(); assert.throws(() => security.path('../outside'), /Unsafe/); assert.throws(() => security.archive([{ path: 'bomb', compressedBytes: 1, uncompressedBytes: 101 }]), /compression ratio/); assert.throws(() => security.xml('<!DOCTYPE x SYSTEM "file:///etc/passwd">'), /forbidden/); assert.throws(() => security.permissions(['network']), /allowlist/); assert.equal(security.report().pass, false) })
|