snowpick/report_test.go

package main

import (
	"io"
	"os"
	"strings"
	"testing"
	"time"
)

func TestFindingCountSummaryCountOracle(t *testing.T) {
	hints := []Hint{{Category: ImpactPII, Basis: "inferred"}}
	got := findingCountSummary(StatusCountOracle, 500, 0, hints)
	want := "500 records [blind oracle] [pii:inferred]"
	if got != want {
		t.Fatalf("findingCountSummary() = %q, want %q", got, want)
	}
}

func TestPrintSummarySeparatesTableCountOracle(t *testing.T) {
	report := &ScanReport{
		TargetsScanned:   1,
		TargetsReachable: 1,
		Findings: []TargetResult{{
			Target:        "TARGET_HOST",
			Reachable:     true,
			TokenObtained: true,
			TableFindings: []TableResult{
				{
					Table:  "sys_user",
					Field:  "name",
					Status: StatusCountOracle,
					Count:  500,
					Hints:  []Hint{{Category: ImpactPII, Basis: "inferred"}},
				},
				{
					Table:       "incident",
					Field:       "number",
					Status:      StatusExposed,
					Count:       2,
					SampleCount: 1,
					Hints:       []Hint{{Category: ImpactOperations, Basis: "inferred"}},
				},
			},
		}},
	}

	output := captureSummaryOutput(t, func() {
		PrintSummary(report, time.Second)
	})

	if !strings.Contains(output, "EXPOSED TARGET_HOST  2 records, 500 count-only [internal_operations:inferred]") {
		t.Fatalf("summary header did not separate count-only records:\n%s", output)
	}
	if !strings.Contains(output, "sys_user.name            500 records [blind oracle] [pii:inferred]") {
		t.Fatalf("count oracle table finding missing blind oracle marker:\n%s", output)
	}
	if strings.Contains(output, "PII                 ") {
		t.Fatalf("count-only PII hint should not appear in DATA CLASSIFICATION:\n%s", output)
	}
	if !strings.Contains(output, "table:sys_user.name [blind oracle]") {
		t.Fatalf("attack surface should label count-only table vector:\n%s", output)
	}
}

func captureSummaryOutput(t *testing.T, fn func()) string {
	t.Helper()

	old := os.Stderr
	r, w, err := os.Pipe()
	if err != nil {
		t.Fatalf("os.Pipe() error = %v", err)
	}
	os.Stderr = w

	fn()

	if err := w.Close(); err != nil {
		t.Fatalf("closing pipe writer: %v", err)
	}
	os.Stderr = old

	data, err := io.ReadAll(r)
	if err != nil {
		t.Fatalf("reading stderr capture: %v", err)
	}
	if err := r.Close(); err != nil {
		t.Fatalf("closing pipe reader: %v", err)
	}
	return string(data)
}