cmdjail/main_test.go at main · endiangroup/cmdjail · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
package main

import (
	"testing"

	"github.com/stretchr/testify/assert"
)

func TestEvaluateCmd(t *testing.T) {
	allowLs := NewLiteralMatcher(newMatcher("+ 'ls -l'", "", 1), "ls -l")
	denyRm, err := NewRegexMatcher(newMatcher("- r'^rm'", "", 2), "^rm")
	assert.NoError(t, err, "failed to compile regex for test")

	t.Run("Deny rule takes precedence over allow rule", func(t *testing.T) {
		allowRm := NewLiteralMatcher(newMatcher("+ 'rm -rf /'", "", 1), "rm -rf /")
		jailFile := JailFile{
			Allow: []Matcher{allowRm},
			Deny:  []Matcher{denyRm},
		}
		result := evaluateCmd("rm -rf /", jailFile)
		assert.False(t, result.Allowed)
		assert.Equal(t, "Matched deny rule", result.Reason)
		assert.Equal(t, denyRm, result.Matcher)
	})

	t.Run("Deny-only mode allows non-matching commands", func(t *testing.T) {
		jailFile := JailFile{
			Deny: []Matcher{denyRm},
		}
		result := evaluateCmd("ls -l", jailFile)
		assert.True(t, result.Allowed)
		assert.Equal(t, "No allow rules defined, command allowed by default", result.Reason)
	})

	t.Run("Allow-only mode blocks non-matching commands", func(t *testing.T) {
		jailFile := JailFile{
			Allow: []Matcher{allowLs},
		}
		result := evaluateCmd("whoami", jailFile)
		assert.False(t, result.Allowed)
		assert.Equal(t, "Implicitly blocked", result.Reason)
	})

	t.Run("Allow-only mode allows matching commands", func(t *testing.T) {
		jailFile := JailFile{
			Allow: []Matcher{allowLs},
		}
		result := evaluateCmd("ls -l", jailFile)
		assert.True(t, result.Allowed)
		assert.Equal(t, "Matched allow rule", result.Reason)
		assert.Equal(t, allowLs, result.Matcher)
	})

	t.Run("Mixed mode implicitly blocks non-matching commands", func(t *testing.T) {
		jailFile := JailFile{
			Allow: []Matcher{allowLs},
			Deny:  []Matcher{denyRm},
		}
		result := evaluateCmd("whoami", jailFile)
		assert.False(t, result.Allowed)
		assert.Equal(t, "Implicitly blocked", result.Reason)
	})

	t.Run("Matcher error results in denial", func(t *testing.T) {
		// This matcher will fail because the command doesn't exist
		errorMatcher := NewCmdMatcher(newMatcher("+ /nonexistent/command", "", 1), "/nonexistent/command", []string{"bash", "-c"})
		jailFile := JailFile{
			Allow: []Matcher{errorMatcher},
		}
		result := evaluateCmd("any", jailFile)
		assert.False(t, result.Allowed)
		assert.Contains(t, result.Reason, "error running matcher")
	})
}