|
1 | 1 | package danger |
2 | 2 |
|
3 | 3 | import ( |
| 4 | + "os" |
4 | 5 | "testing" |
5 | 6 | ) |
6 | 7 |
|
@@ -781,3 +782,150 @@ func TestClassify_SystemRedirectTarget(t *testing.T) { |
781 | 782 | }) |
782 | 783 | } |
783 | 784 | } |
| 785 | + |
| 786 | +func TestClassifyPath_Destructive_Paths(t *testing.T) { |
| 787 | + tests := []struct { |
| 788 | + path string |
| 789 | + want RiskClass |
| 790 | + }{ |
| 791 | + {"/boot/vmlinuz", Destructive}, |
| 792 | + {"/dev/sda1", Destructive}, |
| 793 | + {"/proc/1/cmdline", Destructive}, |
| 794 | + {"/sys/class/power_supply", Destructive}, |
| 795 | + {"/mnt/backup", Destructive}, |
| 796 | + {"/media/usb", Destructive}, |
| 797 | + } |
| 798 | + for _, tt := range tests { |
| 799 | + t.Run(tt.path, func(t *testing.T) { |
| 800 | + got := ClassifyPath(tt.path) |
| 801 | + if got != tt.want { |
| 802 | + t.Errorf("ClassifyPath(%q) = %s, want %s", tt.path, got, tt.want) |
| 803 | + } |
| 804 | + }) |
| 805 | + } |
| 806 | +} |
| 807 | + |
| 808 | +func TestClassifyPath_SystemWrite_Paths(t *testing.T) { |
| 809 | + tests := []struct { |
| 810 | + path string |
| 811 | + want RiskClass |
| 812 | + }{ |
| 813 | + {"/etc/hosts", SystemWrite}, |
| 814 | + {"/etc/nginx/nginx.conf", SystemWrite}, |
| 815 | + {"/root/.bashrc", SystemWrite}, |
| 816 | + {"/var/log/syslog", SystemWrite}, |
| 817 | + {"/var/lib/docker", SystemWrite}, |
| 818 | + {"/run/systemd", SystemWrite}, |
| 819 | + {"/lib/systemd/system", SystemWrite}, |
| 820 | + {"/usr/local/bin/app", SystemWrite}, |
| 821 | + } |
| 822 | + for _, tt := range tests { |
| 823 | + t.Run(tt.path, func(t *testing.T) { |
| 824 | + got := ClassifyPath(tt.path) |
| 825 | + if got != tt.want { |
| 826 | + t.Errorf("ClassifyPath(%q) = %s, want %s", tt.path, got, tt.want) |
| 827 | + } |
| 828 | + }) |
| 829 | + } |
| 830 | +} |
| 831 | + |
| 832 | +func TestClassifyPath_LocalWrite_Paths(t *testing.T) { |
| 833 | + tests := []struct { |
| 834 | + path string |
| 835 | + want RiskClass |
| 836 | + }{ |
| 837 | + {"/tmp/test.txt", LocalWrite}, |
| 838 | + {"/tmp/foo/bar", LocalWrite}, |
| 839 | + {"/home/user/code/main.go", LocalWrite}, |
| 840 | + } |
| 841 | + for _, tt := range tests { |
| 842 | + t.Run(tt.path, func(t *testing.T) { |
| 843 | + got := ClassifyPath(tt.path) |
| 844 | + if got != tt.want { |
| 845 | + t.Errorf("ClassifyPath(%q) = %s, want %s", tt.path, got, tt.want) |
| 846 | + } |
| 847 | + }) |
| 848 | + } |
| 849 | +} |
| 850 | + |
| 851 | +func TestClassifyPath_HomeSensitiveDirs(t *testing.T) { |
| 852 | + home, _ := os.UserHomeDir() |
| 853 | + if home == "" { |
| 854 | + t.Skip("no home dir") |
| 855 | + } |
| 856 | + tests := []struct { |
| 857 | + path string |
| 858 | + want RiskClass |
| 859 | + }{ |
| 860 | + {home + "/.ssh/id_rsa", SystemWrite}, |
| 861 | + {home + "/.config/gh/config.yml", SystemWrite}, |
| 862 | + {home + "/.gnupg/private.key", SystemWrite}, |
| 863 | + {home + "/.aws/credentials", SystemWrite}, |
| 864 | + {home + "/.kube/config", SystemWrite}, |
| 865 | + {home + "/.docker/config.json", SystemWrite}, |
| 866 | + {home + "/.gitconfig", SystemWrite}, |
| 867 | + } |
| 868 | + for _, tt := range tests { |
| 869 | + t.Run(tt.path, func(t *testing.T) { |
| 870 | + got := ClassifyPath(tt.path) |
| 871 | + if got != tt.want { |
| 872 | + t.Errorf("ClassifyPath(%q) = %s, want %s", tt.path, got, tt.want) |
| 873 | + } |
| 874 | + }) |
| 875 | + } |
| 876 | +} |
| 877 | + |
| 878 | +func TestClassifyPath_LongPath(t *testing.T) { |
| 879 | + // Long path under /tmp — should still be local_write |
| 880 | + got := ClassifyPath("/tmp/a/b/c/d/e/f/g/h/file.txt") |
| 881 | + if got != LocalWrite { |
| 882 | + t.Errorf("ClassifyPath(long tmp path) = %s, want local_write", got) |
| 883 | + } |
| 884 | +} |
| 885 | + |
| 886 | +func TestClassifyURL_InternalIPs(t *testing.T) { |
| 887 | + tests := []struct { |
| 888 | + url string |
| 889 | + want RiskClass |
| 890 | + }{ |
| 891 | + {"http://127.0.0.1:8080", SystemWrite}, |
| 892 | + {"http://localhost:3000", SystemWrite}, |
| 893 | + {"http://10.0.0.1/api", SystemWrite}, |
| 894 | + {"http://172.16.0.1", SystemWrite}, |
| 895 | + {"http://192.168.1.1", SystemWrite}, |
| 896 | + {"http://[::1]:8080", SystemWrite}, |
| 897 | + {"https://127.0.0.1", SystemWrite}, |
| 898 | + {"https://10.0.0.5", SystemWrite}, |
| 899 | + {"https://172.20.0.1", SystemWrite}, |
| 900 | + {"https://192.168.0.1", SystemWrite}, |
| 901 | + } |
| 902 | + for _, tt := range tests { |
| 903 | + t.Run(tt.url, func(t *testing.T) { |
| 904 | + got := ClassifyURL(tt.url) |
| 905 | + if got != tt.want { |
| 906 | + t.Errorf("ClassifyURL(%q) = %s, want %s", tt.url, got, tt.want) |
| 907 | + } |
| 908 | + }) |
| 909 | + } |
| 910 | +} |
| 911 | + |
| 912 | +func TestClassifyURL_ExternalURLs(t *testing.T) { |
| 913 | + tests := []struct { |
| 914 | + url string |
| 915 | + want RiskClass |
| 916 | + }{ |
| 917 | + {"https://example.com", NetworkEgress}, |
| 918 | + {"http://api.github.com", NetworkEgress}, |
| 919 | + {"https://google.com/search", NetworkEgress}, |
| 920 | + {"https://8.8.8.8", NetworkEgress}, |
| 921 | + {"http://1.2.3.4", NetworkEgress}, |
| 922 | + } |
| 923 | + for _, tt := range tests { |
| 924 | + t.Run(tt.url, func(t *testing.T) { |
| 925 | + got := ClassifyURL(tt.url) |
| 926 | + if got != tt.want { |
| 927 | + t.Errorf("ClassifyURL(%q) = %s, want %s", tt.url, got, tt.want) |
| 928 | + } |
| 929 | + }) |
| 930 | + } |
| 931 | +} |
0 commit comments