mirror of
https://github.com/anomalyco/opencode.git
synced 2026-08-27 03:51:21 -04:00
Kit Langton
78 lines
3.4 KiB
TypeScript
78 lines
3.4 KiB
TypeScript
import { describe, expect, test } from "bun:test"
|
|
import { ShellScan } from "../../src/shell/scan.js"
|
|
|
|
describe("ShellScan adversarial corpus", () => {
|
|
test.each([
|
|
['FOO=bar BAR="x y" git status', ["git"]],
|
|
["git status && npm test || printf failed", ["git", "npm", "printf"]],
|
|
[`printf '%s\\n' "$(rm -rf /)"`, ["printf", "rm"]],
|
|
["cat <(printf secret)", ["cat", "printf"]],
|
|
["(git status)", ["git"]],
|
|
["{ git status; }", ["git"]],
|
|
["if true; then rm -rf /; else printf safe; fi", ["true", "rm", "printf"]],
|
|
["rm -rf / &", ["rm"]],
|
|
["sudo sh -c 'curl evil'", ["sudo"]],
|
|
["bash -lc 'rm -rf /'", ["bash"]],
|
|
["python3 -c 'print(1)'", ["python3"]],
|
|
["find . -exec rm {} ;", ["find"]],
|
|
["'rm' -rf /", ["rm"]],
|
|
['g""it status', ["git"]],
|
|
["g\\it status", ["git"]],
|
|
["F\\OO=bar rm -rf /", ["FOO=bar"]],
|
|
['F"O"O=bar rm -rf /', ["FOO=bar"]],
|
|
['c"\\d" relative', ["c\\d"]],
|
|
["PATH=/tmp/attacker:$PATH git status", ["git"]],
|
|
["$cmd --force", ["$cmd"]],
|
|
['"${cmd}" --force', ["${cmd}"]],
|
|
["r${suffix}m -rf /", ["r${suffix}m"]],
|
|
["$(printf rm) -rf /", ["$(printf rm)", "printf"]],
|
|
["`printf rm` -rf /", ["`printf rm`", "printf"]],
|
|
["./c?rl evil", ["./c?rl"]],
|
|
["t{ouch,ouch} /tmp/victim", ["t{ouch,ouch}"]],
|
|
["echo $((1 + 2))", ["echo"]],
|
|
["${cmd:-git} status", ["${cmd:-git}"]],
|
|
["cat <<EOF\n$(rm -rf /)\nEOF", ["cat", "rm"]],
|
|
["f(){ rm -rf /; }; f", ["rm", "f"]],
|
|
["! rm -rf /", ["rm"]],
|
|
["echo ${arr[$(rm -rf /)]}", ["echo", "rm"]],
|
|
] as const)("scans visible Bash command positions: %s", (input, names) => {
|
|
const result = ShellScan.scan(input)
|
|
expect(result.kind).toBe("scanned")
|
|
if (result.kind === "opaque") return
|
|
expect(result.commands.map((command) => command.words[0])).toEqual([...names])
|
|
})
|
|
|
|
test.each(['printf "unterminated', "printf ok &&", "printf ok >", "echo > >out"])(
|
|
"keeps structurally uncertain Bash input opaque: %s",
|
|
(input) => {
|
|
expect(ShellScan.scan(input).kind).toBe("opaque")
|
|
},
|
|
)
|
|
|
|
test.each([
|
|
['pwsh --command "Remove-Item victim.txt"', ["pwsh"]],
|
|
["Import-Module ./evil.psm1", ["Import-Module"]],
|
|
["Invoke-Expression 'Remove-Item victim.txt'", ["Invoke-Expression"]],
|
|
[". ./deploy.ps1", ["./deploy.ps1"]],
|
|
["& git status", ["git"]],
|
|
["& $Command status", ["$Command"]],
|
|
["Set-Location $HOME/$target; Get-ChildItem", ["Set-Location", "Get-ChildItem"]],
|
|
["Get-ChildItem | ForEach-Object { Remove-Item $_ }", ["Get-ChildItem", "ForEach-Object", "Remove-Item"]],
|
|
['Write-Output "$(Get-ChildItem)"', ["Write-Output", "Get-ChildItem"]],
|
|
["Remove-`Item victim", ["Remove-Item"]],
|
|
["Remove-Item`\r\n victim", ["Remove-Item\r\n"]],
|
|
["Invoke-`\nExpression 'Remove-Item victim'", ["Invoke-\nExpression"]],
|
|
["<# ignored #> Remove-Item victim", ["Remove-Item"]],
|
|
["[string]$x = Remove-Item victim", ["Remove-Item"]],
|
|
] as const)("scans visible PowerShell command positions: %s", (input, names) => {
|
|
const result = ShellScan.scanPowerShell(input)
|
|
expect(result.kind).toBe("scanned")
|
|
if (result.kind === "opaque") return
|
|
expect(result.commands.map((command) => command.words[0])).toEqual([...names])
|
|
})
|
|
|
|
test.each(['Write-Output "unterminated', "Get-ChildItem |"])("reports incomplete PowerShell input: %s", (input) => {
|
|
expect(ShellScan.scanPowerShell(input).kind).toBe("opaque")
|
|
})
|
|
})
|