mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
d993d57e3d
* feat: Add support for sandbox diagnostic log * fix: Normalize and prioritise sandbox violations * fix: Code review fixes
79 lines
2.3 KiB
Go
79 lines
2.3 KiB
Go
//go:build darwin
|
|
// +build darwin
|
|
|
|
package platform
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/safedep/pmg/sandbox"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestParseSeatbeltLogPayload(t *testing.T) {
|
|
msg := `Sandbox: node(123) deny(1) file-write-data /Users/dev/project/.env ` +
|
|
seatbeltLogMessage("run-1", "file-write", "/Users/dev/project/.env")
|
|
|
|
payload, ok := parseSeatbeltLogPayload(msg)
|
|
require.True(t, ok)
|
|
assert.Equal(t, "run-1", payload.RunID)
|
|
assert.Equal(t, "file-write", payload.Kind)
|
|
assert.Equal(t, "/Users/dev/project/.env", payload.Target)
|
|
}
|
|
|
|
func TestParseSeatbeltLogPayloadEmptyTarget(t *testing.T) {
|
|
msg := `Sandbox: node(123) deny(1) default ` + seatbeltLogMessage("run-1", "default", "")
|
|
|
|
payload, ok := parseSeatbeltLogPayload(msg)
|
|
require.True(t, ok)
|
|
assert.Equal(t, "run-1", payload.RunID)
|
|
assert.Equal(t, "default", payload.Kind)
|
|
assert.Empty(t, payload.Target)
|
|
}
|
|
|
|
func TestExtractSeatbeltDeniedPath(t *testing.T) {
|
|
payload := &seatbeltLogPayload{
|
|
RunID: "run-1",
|
|
Kind: "file-read",
|
|
Target: "**/.env",
|
|
}
|
|
|
|
raw := `Sandbox: node(123) deny(1) file-read-data ./.env ` + seatbeltLogMessage("run-1", "file-read", "**/.env")
|
|
assert.Equal(t, "./.env", extractSeatbeltDeniedPath(raw, payload))
|
|
}
|
|
|
|
func TestDecodeSeatbeltLogEntries(t *testing.T) {
|
|
data := []byte(`[
|
|
{"eventMessage":"entry-1","process":"node"},
|
|
{"eventMessage":"entry-2","process":"npm"}
|
|
]`)
|
|
|
|
entries, err := decodeSeatbeltLogEntries(data)
|
|
require.NoError(t, err)
|
|
require.Len(t, entries, 2)
|
|
assert.Equal(t, "entry-1", entries[0].EventMessage)
|
|
assert.Equal(t, "npm", entries[1].Process)
|
|
}
|
|
|
|
func TestExtractSeatbeltViolations(t *testing.T) {
|
|
entries := []seatbeltLogEntry{
|
|
{
|
|
EventMessage: "Sandbox deny " + seatbeltLogMessage("run-1", "file-read", "/tmp/.env"),
|
|
Process: "node",
|
|
},
|
|
{
|
|
EventMessage: "Sandbox deny " + seatbeltLogMessage("run-2", "file-write", "/tmp/out"),
|
|
Process: "npm",
|
|
},
|
|
}
|
|
|
|
violations := extractSeatbeltViolations(entries, "run-1")
|
|
require.Len(t, violations, 1)
|
|
assert.Equal(t, sandbox.ViolationKindFSRead, violations[0].Kind)
|
|
assert.Equal(t, "file-read", violations[0].RawKind)
|
|
assert.Equal(t, "/tmp/.env", violations[0].Target)
|
|
assert.Equal(t, "/tmp/.env", violations[0].RuleTarget)
|
|
assert.Equal(t, "node", violations[0].Process)
|
|
}
|