mirror of
https://github.com/Strategic-Automation/violin.git
synced 2026-08-14 12:33:37 +02:00
Violin
a51aa00d06
- Updated various playbooks to use `$ENG_DIR` for storing evidence files instead of hardcoded paths. - Enhanced documentation in playbooks to include mandatory CVE and exploit research fields in hypotheses. - Introduced a new `pty-safe-delivery.md` reference for safe file delivery practices over PTY. - Added a `shell_ctrl.py` template for PTY shell control with safeguards against long commands and file transfers. - Improved tests to validate new hypothesis fields and ensure compliance with updated playbook requirements. - General cleanup and consistency improvements across playbooks and templates.
60 lines
2.0 KiB
Python
60 lines
2.0 KiB
Python
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from plugins.violin_guard.core import adapters, execution
|
|
|
|
|
|
def _engagement(tmp_path: Path) -> Path:
|
|
eng = tmp_path / "engagement"
|
|
(eng / "state").mkdir(parents=True)
|
|
(eng / "evidence").mkdir()
|
|
(eng / "state" / "history.md").write_text("# History\n", encoding="utf-8")
|
|
return eng
|
|
|
|
|
|
def test_local_executor_records_receipt_and_history(tmp_path):
|
|
eng = _engagement(tmp_path)
|
|
receipt = execution.execute(
|
|
"echo violin-test",
|
|
eng_dir=str(eng),
|
|
phase="recon",
|
|
timeout_seconds=10,
|
|
label="smoke",
|
|
)
|
|
assert receipt["executed"] is True
|
|
assert receipt["exit_code"] == 0
|
|
assert "violin-test" in receipt["stdout_preview"]
|
|
assert (eng / receipt["evidence_paths"]["manifest"]).exists()
|
|
assert "echo violin-test" in (eng / "state" / "history.md").read_text(encoding="utf-8")
|
|
|
|
|
|
def test_executor_rejects_cwd_escape(tmp_path):
|
|
eng = _engagement(tmp_path)
|
|
with pytest.raises(ValueError, match="inside the engagement"):
|
|
execution.execute("echo blocked", eng_dir=str(eng), phase="recon", cwd="..")
|
|
|
|
|
|
def test_adapter_builders_are_structured_and_bounded():
|
|
assert (
|
|
adapters.build_nmap({"target": "10.0.0.1", "ports": "80,443"})
|
|
== "nmap -sCV -p 80,443 10.0.0.1"
|
|
)
|
|
with pytest.raises(adapters.AdapterError, match="1-65535"):
|
|
adapters.build_nmap({"target": "10.0.0.1", "ports": "-p-"})
|
|
assert "FUZZ" in adapters.build_ffuf(
|
|
{
|
|
"url": "http://10.0.0.1/FUZZ",
|
|
"wordlist": "/tmp/common.txt",
|
|
}
|
|
)
|
|
with pytest.raises(adapters.AdapterError):
|
|
adapters.build_nmap({"target": "10.0.0.1", "ports": "80; rm -rf /"})
|
|
|
|
|
|
def test_search_exploit_reports_missing_tool(monkeypatch):
|
|
monkeypatch.setattr(adapters.shutil, "which", lambda _: None)
|
|
result = adapters.search_exploit({"product": "OpenSSH", "version": "9.0"})
|
|
assert result["available"] is False
|
|
assert result["executed_candidates"] is not True
|