85 lines
4.4 KiB
JavaScript
85 lines
4.4 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import crypto from "node:crypto";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import { pathToFileURL } from "node:url";
|
|
import test from "node:test";
|
|
import ts from "typescript";
|
|
|
|
const root = path.resolve(import.meta.dirname, "../../..");
|
|
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "library-path-security-unit-"));
|
|
for (const name of ["asset-path.ts", "library-source-origin.ts"]) {
|
|
const sourcePath = path.join(root, "web/protocol", name);
|
|
const transpiled = ts.transpileModule(fs.readFileSync(sourcePath, "utf8"), {
|
|
compilerOptions: { module: ts.ModuleKind.ES2022, target: ts.ScriptTarget.ES2022 },
|
|
fileName: sourcePath,
|
|
reportDiagnostics: true,
|
|
});
|
|
assert.deepEqual(transpiled.diagnostics, []);
|
|
fs.writeFileSync(path.join(temporary, name.replace(".ts", ".mjs")), transpiled.outputText.replaceAll('from "./asset-path"', 'from "./asset-path.mjs"'));
|
|
}
|
|
const paths = await import(pathToFileURL(path.join(temporary, "asset-path.mjs")));
|
|
const origin = await import(pathToFileURL(path.join(temporary, "library-source-origin.mjs")));
|
|
const manifest = JSON.parse(fs.readFileSync(path.join(root, "tests/golden/M12-04C/manifest.json"), "utf8"));
|
|
const sha256 = (file) => crypto.createHash("sha256").update(fs.readFileSync(path.join(root, file))).digest("hex");
|
|
const policy = { schemaVersion: 1, declaredHttpsOrigins: ["https://assets.example.test"] };
|
|
const source = (pathValue) => ({ schemaVersion: 1, kind: "PROJECT_ASSET", path: pathValue });
|
|
const remote = (url) => ({ schemaVersion: 1, kind: "HTTPS_ORIGIN", url });
|
|
|
|
test("M12-04C binds the path security gate and evidence artifacts", () => {
|
|
assert.equal(manifest.task, "M12-04C");
|
|
assert.equal(manifest.parentTask, "M12-04B");
|
|
assert.equal(manifest.nextTask, "M12-04D");
|
|
for (const artifact of Object.values(manifest.artifacts)) assert.equal(sha256(artifact.path), artifact.sha256, artifact.path);
|
|
});
|
|
|
|
test("M12-04C rejects absolute, UNC, drive, NUL, control, and origin-style project paths", () => {
|
|
for (const value of [
|
|
"/tmp/library.blend",
|
|
"\\\\server\\share\\library.blend",
|
|
"\\server\\library.blend",
|
|
"C:\\libraries\\main.blend",
|
|
"C:/libraries/main.blend",
|
|
"libraries/\u0000main.blend",
|
|
"libraries/\u0001main.blend",
|
|
"libraries/%00main.blend",
|
|
"//https://evil.example.test/library.blend",
|
|
]) assert.throws(() => paths.normalizeProjectAssetPath(value), /ASSET_PATH_OUTSIDE_PROJECT|ASSET_PATH_INVALID/);
|
|
for (const value of ["/tmp/library.blend", "\\\\server\\share\\library.blend", "C:/libraries/main.blend", "libraries/\u0000main.blend", "libraries/%00main.blend"]) {
|
|
assert.throws(() => origin.acceptLibrarySource(policy, source(value)), { code: "IO_EXTERNAL_URI_BLOCKED" });
|
|
}
|
|
});
|
|
|
|
test("M12-04C rejects raw and encoded unsafe HTTPS URI characters before admission", () => {
|
|
for (const value of [
|
|
"https://assets.example.test\\evil.example.test/main.blend",
|
|
"https://assets.example.test/\nmain.blend",
|
|
"https://assets.example.test/%00main.blend",
|
|
"https://assets.example.test/%01main.blend",
|
|
"https://assets.example.test/%GGmain.blend",
|
|
"https://user:pass@evil.example.test/main.blend",
|
|
"https://evil.example.test/main.blend",
|
|
]) assert.throws(() => origin.acceptLibrarySource(policy, remote(value)), { code: "IO_EXTERNAL_URI_BLOCKED" });
|
|
assert.deepEqual(origin.acceptLibrarySource(policy, remote("https://assets.example.test/library/main.blend")), {
|
|
status: "READY",
|
|
kind: "HTTPS_ORIGIN",
|
|
canonicalLocator: "https://assets.example.test/library/main.blend",
|
|
});
|
|
});
|
|
|
|
test("M12-04C fails closed on policy origin smuggling and duplicate declarations", () => {
|
|
for (const value of [
|
|
"https://assets.example.test\\evil.example.test",
|
|
"https://assets.example.test/%00",
|
|
"https://assets.example.test/%2e",
|
|
"https://assets.example.test/..",
|
|
"https://assets.example.test/library",
|
|
"https://assets.example.test/?scope=library",
|
|
"https://assets.example.test/#library",
|
|
]) assert.throws(() => origin.parseLibrarySourcePolicy({ schemaVersion: 1, declaredHttpsOrigins: [value] }), { code: "IO_EXTERNAL_URI_BLOCKED" });
|
|
assert.throws(() => origin.parseLibrarySourcePolicy({ schemaVersion: 1, declaredHttpsOrigins: ["https://assets.example.test", "https://assets.example.test/"] }), { code: "ASSET_MANIFEST_INVALID" });
|
|
});
|
|
|
|
test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));
|