milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Simplify tests

Browse source
This commit is contained in:
Hans Ott 2025-10-10 14:57:28 +02:00
parent 459f3a5b14
commit 2fa14b82f3
1 changed files with 41 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

39
packages/safe-chain/src/utils/safeSpawn.spec.js
View file

@ -11,14 +11,6 @@ describe("safeSpawn", () => {
// Mock child_process module to capture what command string gets built
mock.module("child_process", {
namedExports: {
spawnSync: (command, options) => {
spawnCalls.push({ command, options });
return {
status: 0,
stdout: Buffer.from(""),
stderr: Buffer.from(""),
};
},
spawn: (command, options) => {
spawnCalls.push({ command, options });
return {
@ -42,22 +34,16 @@ describe("safeSpawn", () => {
mock.reset();
});
// Helper to run either sync or async variant
async function runSafeSpawn(variant, command, args, options) {
return await safeSpawn(command, args, options);
}
for (let variant of ["async"]) {
it(`should pass basic command and arguments correctly (${variant})`, async () => {
await runSafeSpawn(variant, "echo", ["hello"]);
it("should pass basic command and arguments correctly", async () => {
await safeSpawn("echo", ["hello"]);
assert.strictEqual(spawnCalls.length, 1);
assert.strictEqual(spawnCalls[0].command, "echo hello");
assert.strictEqual(spawnCalls[0].options.shell, true);
});
it(`should escape arguments containing spaces (${variant})`, async () => {
await runSafeSpawn(variant, "echo", ["hello world"]);
it("should escape arguments containing spaces", async () => {
await safeSpawn("echo", ["hello world"]);
assert.strictEqual(spawnCalls.length, 1);
// Argument should be escaped to prevent shell interpretation
@ -65,8 +51,8 @@ describe("safeSpawn", () => {
assert.strictEqual(spawnCalls[0].options.shell, true);
});
it(`should prevent shell injection attacks (${variant})`, async () => {
await runSafeSpawn(variant, "ls", ["; rm test123.txt"]);
it("should prevent shell injection attacks", async () => {
await safeSpawn("ls", ["; rm test123.txt"]);
assert.strictEqual(spawnCalls.length, 1);
// Malicious command should be escaped to prevent execution
@ -74,8 +60,8 @@ describe("safeSpawn", () => {
assert.strictEqual(spawnCalls[0].options.shell, true);
});
it(`should escape single quotes in arguments (${variant})`, async () => {
await runSafeSpawn(variant, "echo", ["don't break"]);
it("should escape single quotes in arguments", async () => {
await safeSpawn("echo", ["don't break"]);
assert.strictEqual(spawnCalls.length, 1);
// Single quote should be properly escaped with double quotes
@ -83,8 +69,8 @@ describe("safeSpawn", () => {
assert.strictEqual(spawnCalls[0].options.shell, true);
});
it(`should handle double quotes with simpler escaping (${variant})`, async () => {
await runSafeSpawn(variant, "echo", ['say "hello"']);
it("should handle double quotes with simpler escaping", async () => {
await safeSpawn("echo", ['say "hello"']);
assert.strictEqual(spawnCalls.length, 1);
// If we switch to double quotes, this should be: "say \"hello\""
@ -92,13 +78,12 @@ describe("safeSpawn", () => {
assert.strictEqual(spawnCalls[0].options.shell, true);
});
it(`should not escape arguments with only safe characters (${variant})`, async () => {
await runSafeSpawn(variant, "npm", ["install", "axios", "--save"]);
it("should not escape arguments with only safe characters", async () => {
await safeSpawn("npm", ["install", "axios", "--save"]);
assert.strictEqual(spawnCalls.length, 1);
// Safe arguments (alphanumeric, dash, underscore, dot, slash) shouldn't be quoted
assert.strictEqual(spawnCalls[0].command, "npm install axios --save");
assert.strictEqual(spawnCalls[0].options.shell, true);
});
}
});