Дмитрий
55 lines
1.6 KiB
JavaScript
55 lines
1.6 KiB
JavaScript
import { describe, it, expect } from 'vitest';
|
|
import { tokenizePowerShell, matchPsHardBlacklist } from './enforce-powershell-gate.mjs';
|
|
|
|
describe('tokenizePowerShell', () => {
|
|
it('splits on ; and | into segments', () => {
|
|
const segs = tokenizePowerShell('Get-Content a | Select-String x ; Get-Item b');
|
|
expect(segs.map((s) => s.cmd)).toEqual(['get-content', 'select-string', 'get-item']);
|
|
});
|
|
});
|
|
|
|
describe('matchPsHardBlacklist — keep', () => {
|
|
it.each([
|
|
'Remove-Item x',
|
|
'ri x',
|
|
'del x',
|
|
'Move-Item a b',
|
|
'Copy-Item a b',
|
|
'Set-Content x "y"',
|
|
'Add-Content x "y"',
|
|
'Out-File -FilePath x',
|
|
'cmd > out.txt',
|
|
'Invoke-Expression $x',
|
|
'iex $x',
|
|
'Start-Process notepad',
|
|
'[System.IO.File]::Delete("x")',
|
|
'Stop-Process -Name node',
|
|
'Set-ExecutionPolicy Bypass',
|
|
'icacls x /grant y',
|
|
])('blocks %s', (cmd) => {
|
|
expect(matchPsHardBlacklist(cmd)).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
describe('matchPsHardBlacklist — v4.1 G10', () => {
|
|
it.each([
|
|
'$env:PATH = "x"',
|
|
'$env:ROUTER_LLM_KEY="leak"',
|
|
'[System.Environment]::SetEnvironmentVariable("X","Y")',
|
|
'Set-Item -Path Env:FOO -Value bar',
|
|
'New-PSDrive -Name X -PSProvider FileSystem -Root C:\\',
|
|
'Get-AzVM',
|
|
'New-AzResourceGroup x',
|
|
'Get-AWSCredential',
|
|
'gcloud auth login',
|
|
])('blocks %s', (cmd) => {
|
|
expect(matchPsHardBlacklist(cmd)).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
describe('matchPsHardBlacklist — allows benign', () => {
|
|
it.each(['Get-ChildItem', 'Get-Content app/x.php', 'Select-String x file', 'git status'])('allows %s', (cmd) => {
|
|
expect(matchPsHardBlacklist(cmd)).toBe(null);
|
|
});
|
|
});
|