@@ -0,0 +1,108 @@
1+import { describe, expect, it } from "vitest";
2+import { analyzeShellCommand } from "../infra/exec-approvals-analysis.js";
3+import { resolveExecApprovalsFromFile } from "../infra/exec-approvals.js";
4+import { resolveExecSafeBinRuntimePolicy } from "../infra/exec-safe-bin-runtime-policy.js";
5+import { resolveSystemRunExecArgv } from "./invoke-system-run-allowlist.js";
6+7+function resolveAllowlistApprovals() {
8+return resolveExecApprovalsFromFile({
9+file: {
10+version: 1,
11+defaults: {
12+security: "allowlist",
13+ask: "off",
14+askFallback: "deny",
15+},
16+},
17+});
18+}
19+20+describe("resolveSystemRunExecArgv", () => {
21+it.runIf(process.platform !== "win32")(
22+"keeps rebuilt shell argv behind a final allowlist check",
23+() => {
24+const env = { PATH: "/usr/bin:/bin" };
25+const analysis = analyzeShellCommand({
26+command: "head -c 16",
27+ env,
28+platform: process.platform,
29+});
30+expect(analysis.ok).toBe(true);
31+if (!analysis.ok) {
32+return;
33+}
34+35+const result = resolveSystemRunExecArgv({
36+plannedAllowlistArgv: undefined,
37+argv: ["/bin/sh", "-lc", "head -c 16"],
38+security: "allowlist",
39+approvals: resolveAllowlistApprovals(),
40+safeBins: new Set(),
41+safeBinProfiles: {},
42+trustedSafeBinDirs: new Set(),
43+skillBins: [],
44+autoAllowSkills: false,
45+isWindows: false,
46+policy: {
47+approvedByAsk: false,
48+analysisOk: true,
49+allowlistSatisfied: true,
50+},
51+shellCommand: "head -c 16",
52+segments: analysis.segments,
53+segmentSatisfiedBy: ["safeBins"],
54+cwd: undefined,
55+ env,
56+});
57+58+expect(result).toBeNull();
59+},
60+);
61+62+it.runIf(process.platform !== "win32")(
63+"returns rebuilt shell argv when the final allowlist check passes",
64+() => {
65+const env = { PATH: "/usr/bin:/bin" };
66+const analysis = analyzeShellCommand({
67+command: "head -c 16",
68+ env,
69+platform: process.platform,
70+});
71+expect(analysis.ok).toBe(true);
72+if (!analysis.ok) {
73+return;
74+}
75+const safeBinPolicy = resolveExecSafeBinRuntimePolicy({
76+global: { safeBins: ["head"] },
77+});
78+79+const result = resolveSystemRunExecArgv({
80+plannedAllowlistArgv: undefined,
81+argv: ["/bin/sh", "-lc", "head -c 16"],
82+security: "allowlist",
83+approvals: resolveAllowlistApprovals(),
84+safeBins: safeBinPolicy.safeBins,
85+safeBinProfiles: safeBinPolicy.safeBinProfiles,
86+trustedSafeBinDirs: safeBinPolicy.trustedSafeBinDirs,
87+skillBins: [],
88+autoAllowSkills: false,
89+isWindows: false,
90+policy: {
91+approvedByAsk: false,
92+analysisOk: true,
93+allowlistSatisfied: true,
94+},
95+shellCommand: "head -c 16",
96+segments: analysis.segments,
97+segmentSatisfiedBy: ["safeBins"],
98+cwd: undefined,
99+ env,
100+});
101+102+expect(result).not.toBeNull();
103+expect(result?.[0]).toBe("/bin/sh");
104+expect(result?.[2]).toContain("head");
105+expect(result?.[2]).not.toBe("head -c 16");
106+},
107+);
108+});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。