mirror of
https://github.com/affaan-m/ECC.git
synced 2026-08-17 21:15:40 +02:00
Affaan MustafaandGitHub
382060905e
* fix: harden local data boundaries Bind the capabilities dashboard exclusively to loopback and reject untrusted Host and Origin values. Constrain project-configured agent data paths to the Cursor data root, and harden lifecycle repair/uninstall operations against state-file traversal, symlink swaps, unsafe sources, and forged install-state destinations.\n\nCloses #2506 * fix: eliminate repair source read race Read source bytes and mode from one no-follow file descriptor so a path replacement cannot mix metadata from one inode with content from another. Add a regression that rejects separate path-based source metadata lookup. * fix: close dashboard hardening review gaps
130 lines
4.3 KiB
JavaScript
130 lines
4.3 KiB
JavaScript
/**
|
|
* Tests for scripts/lib/loopback-guard.js
|
|
*
|
|
* Run with: node tests/lib/loopback-guard.test.js
|
|
*/
|
|
|
|
const assert = require('assert');
|
|
|
|
const {
|
|
LOOPBACK_HOSTNAMES,
|
|
buildAllowedHostnames,
|
|
isAllowedHostHeader,
|
|
isAllowedOrigin,
|
|
parseHostHeader
|
|
} = require('../../scripts/lib/loopback-guard');
|
|
|
|
function test(name, fn) {
|
|
try {
|
|
fn();
|
|
console.log(` ✓ ${name}`);
|
|
return true;
|
|
} catch (err) {
|
|
console.log(` ✗ ${name}`);
|
|
console.log(` Error: ${err.message}`);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function runTests() {
|
|
console.log('\n=== Testing loopback-guard.js ===\n');
|
|
|
|
let passed = 0;
|
|
let failed = 0;
|
|
|
|
console.log('parseHostHeader:');
|
|
|
|
if (test('strips port from hostname', () => {
|
|
assert.strictEqual(parseHostHeader('127.0.0.1:4517'), '127.0.0.1');
|
|
assert.strictEqual(parseHostHeader('localhost:80'), 'localhost');
|
|
})) passed++; else failed++;
|
|
|
|
if (test('handles bare hostnames', () => {
|
|
assert.strictEqual(parseHostHeader('localhost'), 'localhost');
|
|
})) passed++; else failed++;
|
|
|
|
if (test('lowercases hostnames', () => {
|
|
assert.strictEqual(parseHostHeader('LocalHost:3000'), 'localhost');
|
|
})) passed++; else failed++;
|
|
|
|
if (test('keeps bracketed IPv6 hosts intact', () => {
|
|
assert.strictEqual(parseHostHeader('[::1]:4517'), '[::1]');
|
|
})) passed++; else failed++;
|
|
|
|
if (test('returns null for missing or malformed values', () => {
|
|
assert.strictEqual(parseHostHeader(null), null);
|
|
assert.strictEqual(parseHostHeader(undefined), null);
|
|
assert.strictEqual(parseHostHeader(''), null);
|
|
assert.strictEqual(parseHostHeader(' '), null);
|
|
assert.strictEqual(parseHostHeader(42), null);
|
|
assert.strictEqual(parseHostHeader('bad:host:extra'), null);
|
|
})) passed++; else failed++;
|
|
|
|
if (test('rejects ports outside the valid TCP range', () => {
|
|
assert.strictEqual(parseHostHeader('localhost:65536'), null);
|
|
assert.strictEqual(parseHostHeader('localhost:99999'), null);
|
|
assert.strictEqual(parseHostHeader('[::1]:65536'), null);
|
|
assert.strictEqual(parseHostHeader('localhost:65535'), 'localhost');
|
|
})) passed++; else failed++;
|
|
|
|
console.log('\nbuildAllowedHostnames:');
|
|
|
|
if (test('always includes loopback names', () => {
|
|
const set = buildAllowedHostnames(null);
|
|
for (const name of LOOPBACK_HOSTNAMES) assert.ok(set.has(name));
|
|
})) passed++; else failed++;
|
|
|
|
if (test('adds the configured host lowercased', () => {
|
|
const set = buildAllowedHostnames('MyBox.Local');
|
|
assert.ok(set.has('mybox.local'));
|
|
})) passed++; else failed++;
|
|
|
|
console.log('\nisAllowedHostHeader:');
|
|
|
|
const allowed = buildAllowedHostnames('127.0.0.1');
|
|
|
|
if (test('accepts loopback host headers', () => {
|
|
assert.strictEqual(isAllowedHostHeader('127.0.0.1:4517', allowed), true);
|
|
assert.strictEqual(isAllowedHostHeader('localhost:4517', allowed), true);
|
|
assert.strictEqual(isAllowedHostHeader('[::1]:4517', allowed), true);
|
|
})) passed++; else failed++;
|
|
|
|
if (test('rejects DNS-rebinding style hostnames', () => {
|
|
assert.strictEqual(isAllowedHostHeader('evil.example.com', allowed), false);
|
|
assert.strictEqual(isAllowedHostHeader('127.0.0.1.evil.example.com', allowed), false);
|
|
})) passed++; else failed++;
|
|
|
|
if (test('rejects missing host header', () => {
|
|
assert.strictEqual(isAllowedHostHeader(undefined, allowed), false);
|
|
})) passed++; else failed++;
|
|
|
|
console.log('\nisAllowedOrigin:');
|
|
|
|
if (test('absent origin is allowed (same-origin nav, CLI)', () => {
|
|
assert.strictEqual(isAllowedOrigin(undefined, allowed), true);
|
|
assert.strictEqual(isAllowedOrigin(null, allowed), true);
|
|
})) passed++; else failed++;
|
|
|
|
if (test('loopback origins are allowed', () => {
|
|
assert.strictEqual(isAllowedOrigin('http://127.0.0.1:4517', allowed), true);
|
|
assert.strictEqual(isAllowedOrigin('http://localhost:4517', allowed), true);
|
|
})) passed++; else failed++;
|
|
|
|
if (test('cross-site origins are rejected', () => {
|
|
assert.strictEqual(isAllowedOrigin('https://evil.example.com', allowed), false);
|
|
})) passed++; else failed++;
|
|
|
|
if (test('malformed origins are rejected', () => {
|
|
assert.strictEqual(isAllowedOrigin('not a url', allowed), false);
|
|
})) passed++; else failed++;
|
|
|
|
console.log('\n' + '='.repeat(40));
|
|
console.log(`Passed: ${passed}`);
|
|
console.log(`Failed: ${failed}`);
|
|
console.log('='.repeat(40));
|
|
|
|
process.exit(failed > 0 ? 1 : 0);
|
|
}
|
|
|
|
runTests();
|