mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
b8588e3df4
* feat: add sandbox DX commands * fix: Linter errors * fix: Sandbox deny log parsing * fix: Sandbox docs * refactor: Maintain SSOT across pkg dependencies * fix: Linter errors
86 lines
2.6 KiB
Go
86 lines
2.6 KiB
Go
package executor
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"os/exec"
|
|
"testing"
|
|
|
|
"github.com/safedep/pmg/sandbox"
|
|
"github.com/safedep/pmg/usefulerror"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type fakeViolationSandbox struct {
|
|
report *sandbox.ViolationReport
|
|
}
|
|
|
|
func (f *fakeViolationSandbox) Execute(context.Context, *exec.Cmd, *sandbox.SandboxPolicy) (*sandbox.ExecutionResult, error) {
|
|
return sandbox.NewExecutionResult(), nil
|
|
}
|
|
|
|
func (f *fakeViolationSandbox) Name() sandbox.DriverName {
|
|
return sandbox.DriverSeatbelt
|
|
}
|
|
|
|
func (f *fakeViolationSandbox) IsAvailable() bool {
|
|
return true
|
|
}
|
|
|
|
func (f *fakeViolationSandbox) Close() error {
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeViolationSandbox) BestEffortViolation(error) (*sandbox.ViolationReport, error) {
|
|
return f.report, nil
|
|
}
|
|
|
|
// WrapCommandExecutionError must never claim the sandbox blocked a command.
|
|
// Even when violations were observed, the user-facing error stays the package
|
|
// manager's native exit; a neutral breadcrumb points at the forensic command.
|
|
func TestWrapCommandExecutionErrorDoesNotAttributeFailureToSandbox(t *testing.T) {
|
|
result := sandbox.NewExecutionResult(sandbox.WithExecutionResultSandbox(&fakeViolationSandbox{
|
|
report: &sandbox.ViolationReport{
|
|
SandboxName: sandbox.DriverSeatbelt,
|
|
PolicyName: "npm-restrictive",
|
|
CorrelationID: "run-1",
|
|
Violations: []sandbox.Violation{
|
|
{
|
|
Kind: sandbox.ViolationKindFSRead,
|
|
RawKind: "file-read",
|
|
Target: "./.env",
|
|
RuleTarget: "**/.env",
|
|
RuleLabel: "read access denied: ./.env",
|
|
},
|
|
},
|
|
},
|
|
}))
|
|
|
|
err := WrapCommandExecutionError(errors.New("npm failed"), result, 1)
|
|
|
|
usefulErr, ok := usefulerror.AsUsefulError(err)
|
|
require.True(t, ok)
|
|
assert.Equal(t, usefulerror.ErrCodePackageManagerExecutionFailed, usefulErr.Code())
|
|
assert.Equal(t, "Package manager command exited with code: 1", usefulErr.HumanError())
|
|
assert.NotContains(t, usefulErr.Help(), "./.env")
|
|
assert.Contains(t, usefulErr.AdditionalHelp(), "pmg sandbox violations list")
|
|
}
|
|
|
|
func TestWrapCommandExecutionErrorOmitsBreadcrumbWhenNoViolations(t *testing.T) {
|
|
result := sandbox.NewExecutionResult(sandbox.WithExecutionResultSandbox(&fakeViolationSandbox{
|
|
report: nil,
|
|
}))
|
|
|
|
err := WrapCommandExecutionError(errors.New("npm failed"), result, 1)
|
|
|
|
usefulErr, ok := usefulerror.AsUsefulError(err)
|
|
require.True(t, ok)
|
|
assert.Equal(t, usefulerror.ErrCodePackageManagerExecutionFailed, usefulErr.Code())
|
|
assert.NotContains(t, usefulErr.AdditionalHelp(), "pmg sandbox violations list")
|
|
}
|
|
|
|
func TestWrapCommandExecutionErrorReturnsNilOnNilError(t *testing.T) {
|
|
assert.NoError(t, WrapCommandExecutionError(nil, nil, 0))
|
|
}
|