test(security): cover bundled plugin allowlist audit · op...

Recent Commits to openclaw:main

steipete · 2026-04-27 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,16 @@ const mockChannelPlugins = vi.hoisted(() => [`
`19`	`19`	`},`
`20`	`20`	`},`
`21`	`21`	`]);`
	`22`	`+const mockPluginRegistryIds = vi.hoisted(() => [`
	`23`	`+"active-memory",`
	`24`	`+"anthropic",`
	`25`	`+"brave",`
	`26`	`+"discord",`
	`27`	`+"google",`
	`28`	`+"lmstudio",`
	`29`	`+"memory-core",`
	`30`	`+"ollama",`
	`31`	`+]);`
`22`	`32`
`23`	`33`	`const readInstalledPackageVersionMock = vi.hoisted(() =>`
`24`	`34`	`vi.fn(async (dir: string) => {`
`@@ -87,7 +97,7 @@ vi.mock("../plugins/plugin-registry.js", () => ({`
`87`	`97`	`createPluginRegistryIdNormalizer: () => (id: string) => id,`
`88`	`98`	`loadPluginRegistrySnapshot: () => ({`
`89`	`99`	`diagnostics: [],`
`90`		`-plugins: [{ pluginId: "discord" }],`
	`100`	`+plugins: mockPluginRegistryIds.map((pluginId) => ({ pluginId })),`
`91`	`101`	`}),`
`92`	`102`	`}));`
`93`	`103`
`@@ -349,6 +359,35 @@ describe("security audit install metadata findings", () => {`
`349`	`359`	`expect(phantomFinding?.detail).toContain("ghost-plugin-xyz");`
`350`	`360`	`expect(phantomFinding?.detail).not.toContain("installed-plugin");`
`351`	`361`	`});`
	`362`	`+`
	`363`	`+it("does not report bundled provider and utility plugins as phantom allowlist entries", async () => {`
	`364`	`+const stateDir = await makeTmpDir("phantom-bundled-providers");`
	`365`	`+await fs.mkdir(path.join(stateDir, "extensions", "installed-plugin"), {`
	`366`	`+recursive: true,`
	`367`	`+});`
	`368`	`+`
	`369`	`+const findings = await runInstallMetadataAudit(`
	`370`	`+{`
	`371`	`+plugins: {`
	`372`	`+allow: [`
	`373`	`+"active-memory",`
	`374`	`+"anthropic",`
	`375`	`+"brave",`
	`376`	`+"google",`
	`377`	`+"lmstudio",`
	`378`	`+"memory-core",`
	`379`	`+"ollama",`
	`380`	`+"installed-plugin",`
	`381`	`+],`
	`382`	`+},`
	`383`	`+},`
	`384`	`+stateDir,`
	`385`	`+);`
	`386`	`+`
	`387`	`+expect(`
	`388`	`+findings.find((finding) => finding.checkId === "plugins.allow_phantom_entries"),`
	`389`	`+).toBeUndefined();`
	`390`	`+});`
`352`	`391`	`});`
`353`	`392`
`354`	`393`	`describe("security audit extension tool reachability findings", () => {`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main