@@ -881,12 +881,6 @@ describe("windowsEscapeArg", () => {
881881});
882882883883describe("matchAllowlist with argPattern", () => {
884-// argPattern matching is Windows-only; skip this suite on other platforms.
885-if (process.platform !== "win32") {
886-it.skip("argPattern tests are Windows-only", () => {});
887-return;
888-}
889-890884const resolution = {
891885rawExecutable: "python3",
892886resolvedPath: "/usr/bin/python3",
@@ -907,25 +901,57 @@ describe("matchAllowlist with argPattern", () => {
907901expect(matchAllowlist(entries, resolution, ["python3", "a.py", "--verbose"])).toBeNull();
908902});
909903910-it("prefers argPattern match over path-only match", () => {
904+it.each(["linux", "darwin"])("enforces argPattern on %s", (platform) => {
911905const entries: ExecAllowlistEntry[] = [
912-{ pattern: "/usr/bin/python3" },
913-{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
906+{ pattern: "/usr/bin/python3", argPattern: "^safe\\.py$" },
914907];
915-const match = matchAllowlist(entries, resolution, ["python3", "a.py"]);
916-expect(match).toBeTruthy();
917-expect(match!.argPattern).toBe("^a\\.py$");
908+expect(matchAllowlist(entries, resolution, ["python3", "safe.py"], platform)).toBeTruthy();
909+expect(matchAllowlist(entries, resolution, ["python3", "-c", "print(1)"], platform)).toBeNull();
918910});
919911920-it("falls back to path-only match when argPattern doesn't match", () => {
921-const entries: ExecAllowlistEntry[] = [
922-{ pattern: "/usr/bin/python3" },
923-{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
924-];
925-const match = matchAllowlist(entries, resolution, ["python3", "b.py"]);
926-expect(match).toBeTruthy();
927-expect(match!.argPattern).toBeUndefined();
928-});
912+it.each(["linux", "darwin", "win32"])(
913+"prefers argPattern match over path-only match on %s",
914+(platform) => {
915+const entries: ExecAllowlistEntry[] = [
916+{ pattern: "/usr/bin/python3" },
917+{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
918+];
919+const match = matchAllowlist(entries, resolution, ["python3", "a.py"], platform);
920+expect(match).toBeTruthy();
921+expect(match!.argPattern).toBe("^a\\.py$");
922+},
923+);
924+925+it.each(["linux", "darwin", "win32"])(
926+"falls back to path-only match when argPattern does not match on %s",
927+(platform) => {
928+const entries: ExecAllowlistEntry[] = [
929+{ pattern: "/usr/bin/python3" },
930+{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
931+];
932+const match = matchAllowlist(entries, resolution, ["python3", "b.py"], platform);
933+expect(match).toBeTruthy();
934+expect(match!.argPattern).toBeUndefined();
935+},
936+);
937+938+it.each(["linux", "darwin", "win32"])(
939+"requires argv before matching argPattern entries on %s",
940+(platform) => {
941+const restrictedEntries: ExecAllowlistEntry[] = [
942+{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
943+];
944+expect(matchAllowlist(restrictedEntries, resolution, undefined, platform)).toBeNull();
945+946+const mixedEntries: ExecAllowlistEntry[] = [
947+{ pattern: "/usr/bin/python3", argPattern: "^a\\.py$" },
948+{ pattern: "/usr/bin/python3" },
949+];
950+const fallback = matchAllowlist(mixedEntries, resolution, undefined, platform);
951+expect(fallback).toBeTruthy();
952+expect(fallback!.argPattern).toBeUndefined();
953+},
954+);
929955930956it("handles invalid regex gracefully", () => {
931957const entries: ExecAllowlistEntry[] = [{ pattern: "/usr/bin/python3", argPattern: "[invalid" }];
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。