157 lines
3.6 KiB
Go
157 lines
3.6 KiB
Go
package sandbox
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func TestIsDangerousEnvVar(t *testing.T) {
|
|
tests := []struct {
|
|
entry string
|
|
dangerous bool
|
|
}{
|
|
// Linux LD_* variables
|
|
{"LD_PRELOAD=/tmp/evil.so", true},
|
|
{"LD_LIBRARY_PATH=/tmp", true},
|
|
{"LD_AUDIT=/tmp/audit.so", true},
|
|
{"LD_DEBUG=all", true},
|
|
|
|
// macOS DYLD_* variables
|
|
{"DYLD_INSERT_LIBRARIES=/tmp/evil.dylib", true},
|
|
{"DYLD_LIBRARY_PATH=/tmp", true},
|
|
{"DYLD_FRAMEWORK_PATH=/tmp", true},
|
|
{"DYLD_FORCE_FLAT_NAMESPACE=1", true},
|
|
|
|
// Safe variables
|
|
{"PATH=/usr/bin:/bin", false},
|
|
{"HOME=/home/user", false},
|
|
{"USER=user", false},
|
|
{"SHELL=/bin/bash", false},
|
|
{"HTTP_PROXY=http://localhost:8080", false},
|
|
{"HTTPS_PROXY=http://localhost:8080", false},
|
|
|
|
// Edge cases - variables that start with similar prefixes but aren't dangerous
|
|
{"LDFLAGS=-L/usr/lib", false}, // Not LD_ prefix
|
|
{"DISPLAY=:0", false},
|
|
|
|
// Empty and malformed
|
|
{"LD_PRELOAD", true}, // No value but still dangerous
|
|
{"", false},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.entry, func(t *testing.T) {
|
|
got := isDangerousEnvVar(tt.entry)
|
|
if got != tt.dangerous {
|
|
t.Errorf("isDangerousEnvVar(%q) = %v, want %v", tt.entry, got, tt.dangerous)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestFilterDangerousEnv(t *testing.T) {
|
|
env := []string{
|
|
"PATH=/usr/bin:/bin",
|
|
"LD_PRELOAD=/tmp/evil.so",
|
|
"HOME=/home/user",
|
|
"DYLD_INSERT_LIBRARIES=/tmp/evil.dylib",
|
|
"HTTP_PROXY=http://localhost:8080",
|
|
"LD_LIBRARY_PATH=/tmp",
|
|
}
|
|
|
|
filtered := FilterDangerousEnv(env)
|
|
|
|
// Should have 3 safe vars
|
|
if len(filtered) != 3 {
|
|
t.Errorf("expected 3 safe vars, got %d: %v", len(filtered), filtered)
|
|
}
|
|
|
|
// Verify the safe vars are present
|
|
expected := map[string]bool{
|
|
"PATH=/usr/bin:/bin": true,
|
|
"HOME=/home/user": true,
|
|
"HTTP_PROXY=http://localhost:8080": true,
|
|
}
|
|
|
|
for _, e := range filtered {
|
|
if !expected[e] {
|
|
t.Errorf("unexpected var in filtered env: %s", e)
|
|
}
|
|
}
|
|
|
|
// Verify dangerous vars are gone
|
|
for _, e := range filtered {
|
|
if isDangerousEnvVar(e) {
|
|
t.Errorf("dangerous var not filtered: %s", e)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestGetStrippedEnvVars(t *testing.T) {
|
|
env := []string{
|
|
"PATH=/usr/bin",
|
|
"LD_PRELOAD=/tmp/evil.so",
|
|
"DYLD_INSERT_LIBRARIES=/tmp/evil.dylib",
|
|
"HOME=/home/user",
|
|
}
|
|
|
|
stripped := GetStrippedEnvVars(env)
|
|
|
|
if len(stripped) != 2 {
|
|
t.Errorf("expected 2 stripped vars, got %d: %v", len(stripped), stripped)
|
|
}
|
|
|
|
// Should contain just the keys, not values
|
|
found := make(map[string]bool)
|
|
for _, s := range stripped {
|
|
found[s] = true
|
|
}
|
|
|
|
if !found["LD_PRELOAD"] {
|
|
t.Error("expected LD_PRELOAD to be in stripped list")
|
|
}
|
|
if !found["DYLD_INSERT_LIBRARIES"] {
|
|
t.Error("expected DYLD_INSERT_LIBRARIES to be in stripped list")
|
|
}
|
|
}
|
|
|
|
func TestFilterDangerousEnv_EmptyInput(t *testing.T) {
|
|
filtered := FilterDangerousEnv(nil)
|
|
if filtered == nil {
|
|
t.Error("expected non-nil slice for nil input")
|
|
}
|
|
if len(filtered) != 0 {
|
|
t.Errorf("expected empty slice, got %v", filtered)
|
|
}
|
|
|
|
filtered = FilterDangerousEnv([]string{})
|
|
if len(filtered) != 0 {
|
|
t.Errorf("expected empty slice, got %v", filtered)
|
|
}
|
|
}
|
|
|
|
func TestFilterDangerousEnv_AllDangerous(t *testing.T) {
|
|
env := []string{
|
|
"LD_PRELOAD=/tmp/evil.so",
|
|
"LD_LIBRARY_PATH=/tmp",
|
|
"DYLD_INSERT_LIBRARIES=/tmp/evil.dylib",
|
|
}
|
|
|
|
filtered := FilterDangerousEnv(env)
|
|
if len(filtered) != 0 {
|
|
t.Errorf("expected all vars to be filtered, got %v", filtered)
|
|
}
|
|
}
|
|
|
|
func TestFilterDangerousEnv_AllSafe(t *testing.T) {
|
|
env := []string{
|
|
"PATH=/usr/bin",
|
|
"HOME=/home/user",
|
|
"USER=test",
|
|
}
|
|
|
|
filtered := FilterDangerousEnv(env)
|
|
if len(filtered) != 3 {
|
|
t.Errorf("expected all 3 vars to pass through, got %d", len(filtered))
|
|
}
|
|
}
|