@@ -888,60 +888,47 @@ describe("matchAllowlist with argPattern", () => {
888888};
889889890890it("matches path-only entry regardless of argv", () => {
891-const entries: ExecAllowlistEntry[] = [{ pattern: "/usr/bin/python3" }];
892-expect(matchAllowlist(entries, resolution, ["python3", "a.py"])).toMatchObject({
893-pattern: "/usr/bin/python3",
894-});
895-expect(matchAllowlist(entries, resolution, ["python3", "b.py"])).toMatchObject({
896-pattern: "/usr/bin/python3",
897-});
898-expect(matchAllowlist(entries, resolution, ["python3"])).toMatchObject({
899-pattern: "/usr/bin/python3",
900-});
891+const entry = { pattern: "/usr/bin/python3" };
892+const entries: ExecAllowlistEntry[] = [entry];
893+expect(matchAllowlist(entries, resolution, ["python3", "a.py"])).toBe(entry);
894+expect(matchAllowlist(entries, resolution, ["python3", "b.py"])).toBe(entry);
895+expect(matchAllowlist(entries, resolution, ["python3"])).toBe(entry);
901896});
902897903898it("matches argPattern with regex", () => {
904-const entries: ExecAllowlistEntry[] = [{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" }];
905-expect(matchAllowlist(entries, resolution, ["python3", "a.py"])).toMatchObject({
906-argPattern: "^a\\.py$",
907-});
899+const entry = { pattern: "/usr/bin/python3", argPattern: "^a\\.py$" };
900+const entries: ExecAllowlistEntry[] = [entry];
901+expect(matchAllowlist(entries, resolution, ["python3", "a.py"])).toBe(entry);
908902expect(matchAllowlist(entries, resolution, ["python3", "b.py"])).toBeNull();
909903expect(matchAllowlist(entries, resolution, ["python3", "a.py", "--verbose"])).toBeNull();
910904});
911905912906it.each(["linux", "darwin"])("enforces argPattern on %s", (platform) => {
913-const entries: ExecAllowlistEntry[] = [
914-{ pattern: "/usr/bin/python3", argPattern: "^safe\\.py$" },
915-];
916-expect(matchAllowlist(entries, resolution, ["python3", "safe.py"], platform)).toMatchObject({
917-argPattern: "^safe\\.py$",
918-});
907+const entry = { pattern: "/usr/bin/python3", argPattern: "^safe\\.py$" };
908+const entries: ExecAllowlistEntry[] = [entry];
909+expect(matchAllowlist(entries, resolution, ["python3", "safe.py"], platform)).toBe(entry);
919910expect(matchAllowlist(entries, resolution, ["python3", "-c", "print(1)"], platform)).toBeNull();
920911});
921912922913it.each(["linux", "darwin", "win32"])(
923914"prefers argPattern match over path-only match on %s",
924915(platform) => {
925-const entries: ExecAllowlistEntry[] = [
926-{ pattern: "/usr/bin/python3" },
927-{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
928-];
916+const pathOnlyEntry = { pattern: "/usr/bin/python3" };
917+const argPatternEntry = { pattern: "/usr/bin/python3", argPattern: "^a\\.py$" };
918+const entries: ExecAllowlistEntry[] = [pathOnlyEntry, argPatternEntry];
929919const match = matchAllowlist(entries, resolution, ["python3", "a.py"], platform);
930-expect(match).toMatchObject({ pattern: "/usr/bin/python3" });
931-expect(match!.argPattern).toBe("^a\\.py$");
920+expect(match).toBe(argPatternEntry);
932921},
933922);
934923935924it.each(["linux", "darwin", "win32"])(
936925"falls back to path-only match when argPattern does not match on %s",
937926(platform) => {
938-const entries: ExecAllowlistEntry[] = [
939-{ pattern: "/usr/bin/python3" },
940-{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
941-];
927+const pathOnlyEntry = { pattern: "/usr/bin/python3" };
928+const argPatternEntry = { pattern: "/usr/bin/python3", argPattern: "^a\\.py$" };
929+const entries: ExecAllowlistEntry[] = [pathOnlyEntry, argPatternEntry];
942930const match = matchAllowlist(entries, resolution, ["python3", "b.py"], platform);
943-expect(match).toMatchObject({ pattern: "/usr/bin/python3" });
944-expect(match!.argPattern).toBeUndefined();
931+expect(match).toBe(pathOnlyEntry);
945932},
946933);
947934@@ -958,8 +945,7 @@ describe("matchAllowlist with argPattern", () => {
958945{ pattern: "/usr/bin/python3" },
959946];
960947const fallback = matchAllowlist(mixedEntries, resolution, undefined, platform);
961-expect(fallback).toMatchObject({ pattern: "/usr/bin/python3" });
962-expect(fallback!.argPattern).toBeUndefined();
948+expect(fallback).toBe(mixedEntries[1]);
963949},
964950);
965951@@ -973,48 +959,34 @@ describe("matchAllowlist with argPattern", () => {
973959// matchArgPattern can detect \x00-join style via .includes("\x00") even for
974960// single-arg patterns. "^hello world\x00$" is the auto-generated form for
975961// argv ["python3", "hello world"].
976-const entries: ExecAllowlistEntry[] = [
977-{ pattern: "/usr/bin/python3", argPattern: "^hello world\x00$" },
978-];
962+const entry = { pattern: "/usr/bin/python3", argPattern: "^hello world\x00$" };
963+const entries: ExecAllowlistEntry[] = [entry];
979964// Original approved single-arg must still match (argsString = "hello world\x00").
980-expect(matchAllowlist(entries, resolution, ["python3", "hello world"])).toMatchObject({
981-argPattern: "^hello world\x00$",
982-});
965+expect(matchAllowlist(entries, resolution, ["python3", "hello world"])).toBe(entry);
983966// Split-arg bypass must be rejected (argsString = "hello\x00world\x00").
984967expect(matchAllowlist(entries, resolution, ["python3", "hello", "world"])).toBeNull();
985968});
986969987970it("supports regex alternation in argPattern", () => {
988-const entries: ExecAllowlistEntry[] = [
989-{ pattern: "/usr/bin/python3", argPattern: "^(a|b)\\.py$" },
990-];
991-expect(matchAllowlist(entries, resolution, ["python3", "a.py"])).toMatchObject({
992-argPattern: "^(a|b)\\.py$",
993-});
994-expect(matchAllowlist(entries, resolution, ["python3", "b.py"])).toMatchObject({
995-argPattern: "^(a|b)\\.py$",
996-});
971+const entry = { pattern: "/usr/bin/python3", argPattern: "^(a|b)\\.py$" };
972+const entries: ExecAllowlistEntry[] = [entry];
973+expect(matchAllowlist(entries, resolution, ["python3", "a.py"])).toBe(entry);
974+expect(matchAllowlist(entries, resolution, ["python3", "b.py"])).toBe(entry);
997975expect(matchAllowlist(entries, resolution, ["python3", "c.py"])).toBeNull();
998976});
9999771000978it("distinguishes zero-arg pattern from one-empty-string-arg pattern", () => {
1001979// buildArgPatternFromArgv encodes [] as "^\x00\x00$" (double sentinel) and
1002980// [""] as "^\x00$" (single sentinel) so the two cannot cross-match.
1003-const zeroArgEntries: ExecAllowlistEntry[] = [
1004-{ pattern: "/usr/bin/python3", argPattern: "^\x00\x00$" },
1005-];
1006-const emptyArgEntries: ExecAllowlistEntry[] = [
1007-{ pattern: "/usr/bin/python3", argPattern: "^\x00$" },
1008-];
981+const zeroArgEntry = { pattern: "/usr/bin/python3", argPattern: "^\x00\x00$" };
982+const emptyArgEntry = { pattern: "/usr/bin/python3", argPattern: "^\x00$" };
983+const zeroArgEntries: ExecAllowlistEntry[] = [zeroArgEntry];
984+const emptyArgEntries: ExecAllowlistEntry[] = [emptyArgEntry];
1009985// Zero-arg command must match zero-arg pattern but not empty-string-arg pattern.
1010-expect(matchAllowlist(zeroArgEntries, resolution, ["python3"])).toMatchObject({
1011-argPattern: "^\x00\x00$",
1012-});
986+expect(matchAllowlist(zeroArgEntries, resolution, ["python3"])).toBe(zeroArgEntry);
1013987expect(matchAllowlist(emptyArgEntries, resolution, ["python3"])).toBeNull();
1014988// One-empty-string-arg command must match empty-string-arg pattern but not zero-arg pattern.
1015-expect(matchAllowlist(emptyArgEntries, resolution, ["python3", ""])).toMatchObject({
1016-argPattern: "^\x00$",
1017-});
989+expect(matchAllowlist(emptyArgEntries, resolution, ["python3", ""])).toBe(emptyArgEntry);
1018990expect(matchAllowlist(zeroArgEntries, resolution, ["python3", ""])).toBeNull();
1019991});
1020992});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。