mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-10 10:40:32 +01:00
Garry Tanandcapy-ai[bot]
9dc1dfb729
* fix(windows): shell bins pass NUL as Bun's empty config when MSYS path conversion is off (#3415) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(windows): detect Git Bash/MSYS2/Cygwin from OSTYPE, as gstack-doctor does, so uname stubs in setup fixtures stay untouched Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes (#3415) - Choose NUL only when cygpath is also on PATH, so an OSTYPE=msys inherited by a POSIX bash keeps /dev/null instead of a cwd-relative NUL file. - gstack-developer-profile --log-session reports a Bun failure instead of skipping it as invalid input, like gstack-timeline-log. - learnings-injection tests check that their anchored bun -e block exists. - CHANGELOG names the callers this fix does not cover; curation reason fixed. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes, cycle 2 (#3415) - timeline-log and developer-profile validators print their verdict; any non-zero Bun exit is a reported failure (a Bun crash on Windows exits 3). - timeline-log keeps the original event when ts stamping fails. - The definition ratchet scopes a local GSTACK_BUN_CONFIG to its function. - The shell-bins fixture clears its preload marker per test. - CHANGELOG states the callers that discard the report and the Bun 1.3.x case. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: CHANGELOG notes Bun 1.3.10 evidence and remaining literal /dev/null callers (#3415) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
39 lines
1.5 KiB
TypeScript
39 lines
1.5 KiB
TypeScript
import { describe, it, expect } from 'bun:test';
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
import { spawnSync } from 'child_process';
|
|
|
|
const SCRIPT_PATH = path.join(import.meta.dir, '../../bin/gstack-learnings-search');
|
|
const SCRIPT = fs.readFileSync(SCRIPT_PATH, 'utf-8');
|
|
const BIN_DIR = path.join(import.meta.dir, '../../bin');
|
|
const BUN_BLOCK_AT = SCRIPT.indexOf('bun --no-env-file --config="${GSTACK_BUN_CONFIG:-/dev/null}" -e');
|
|
|
|
describe('gstack-learnings-search injection safety', () => {
|
|
it('finds the bun -e block the checks below read', () => {
|
|
expect(BUN_BLOCK_AT).toBeGreaterThanOrEqual(0);
|
|
});
|
|
|
|
it('must not interpolate variables into JS string literals', () => {
|
|
const jsBlock = SCRIPT.slice(BUN_BLOCK_AT);
|
|
expect(jsBlock).not.toMatch(/const \w+ = '\$\{/);
|
|
expect(jsBlock).not.toMatch(/= \$\{[A-Z_]+\};/);
|
|
expect(jsBlock).not.toMatch(/'\$\{CROSS_PROJECT\}'/);
|
|
});
|
|
|
|
it('must use process.env for parameters', () => {
|
|
const jsBlock = SCRIPT.slice(BUN_BLOCK_AT);
|
|
expect(jsBlock).toContain('process.env');
|
|
});
|
|
});
|
|
|
|
describe('gstack-learnings-search injection behavioral', () => {
|
|
it('handles single quotes in query safely', () => {
|
|
const result = spawnSync('bash', [
|
|
path.join(BIN_DIR, 'gstack-learnings-search'),
|
|
'--query', "test'; process.exit(99); //",
|
|
'--limit', '1'
|
|
], { encoding: 'utf-8', timeout: 5000, env: { ...process.env, HOME: '/tmp/nonexistent-gstack-test' } });
|
|
expect(result.status).not.toBe(99);
|
|
});
|
|
});
|