mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-01 19:25:10 +02:00
7450b5160b
* fix: remove auth token from /health, secure extension bootstrap (CRITICAL-02 + HIGH-03) - Remove token from /health response (was leaked to any localhost process) - Write .auth.json to extension dir for Manifest V3 bootstrap - sidebar-agent reads token from state file via BROWSE_STATE_FILE env var - Remove getToken handler from extension (token via health broadcast) - Extension loads token before first health poll to prevent race condition * fix: require auth on cookie-picker data routes (CRITICAL-01) - Add Bearer token auth gate on all /cookie-picker/* data/action routes - GET /cookie-picker HTML page stays unauthenticated (UI shell) - Token embedded in served HTML for picker's fetch calls - CORS preflight now allows Authorization header * fix: add state file TTL and plaintext cookie warning (HIGH-02) - Add savedAt timestamp to state save output - Warn on load if state file older than 7 days - Auto-delete stale state files (>7 days) on server startup - Warning about plaintext cookie storage in save message * fix: innerHTML XSS in extension content script and sidepanel (MEDIUM-01) - content.js: replace innerHTML with createElement/textContent for ref panel - sidepanel.js: escape entry.command with escapeHtml() in activity feed - Both found by security audit + Codex adversarial red team * fix: symlink bypass in validateReadPath (MEDIUM-02) - Always resolve to absolute path first (fixes relative path bypass) - Use realpathSync to follow symlinks before boundary check - Throw on non-ENOENT realpathSync failures (explicit over silent) - Resolve SAFE_DIRECTORIES through realpathSync (macOS /tmp → /private/tmp) - Resolve directory part for non-existent files (ENOENT with symlinked parent) * fix: freeze hook symlink bypass and prefix collision (MEDIUM-03) - Add POSIX-portable path resolution (cd + pwd -P, works on macOS) - Fix prefix collision: /project-evil no longer matches /project freeze dir - Use trailing slash in boundary check to require directory boundary * fix: shell script injection in gstack-config and telemetry (MEDIUM-04) - gstack-config: validate keys (alphanumeric+underscore only) - gstack-config: use grep -F (fixed string) instead of -E (regex) - gstack-config: escape sed special chars in values, drop newlines - gstack-telemetry-log: sanitize REPO_SLUG and BRANCH via json_safe() * test: 20 security tests for audit remediation - server-auth: verify token removed from /health, auth on /refs, /activity/* - cookie-picker: auth required on data routes, HTML page unauthenticated - path-validation: symlink bypass blocked, realpathSync failure throws - gstack-config: regex key rejected, sed special chars preserved - state-ttl: savedAt timestamp, 7-day TTL warning - telemetry: branch/repo with quotes don't corrupt JSON - adversarial: sidepanel escapes entry.command, freeze prefix collision * chore: bump version and changelog (v0.13.1.0) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: tone down changelog — defense in depth, not catastrophic bugs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
139 lines
5.2 KiB
TypeScript
139 lines
5.2 KiB
TypeScript
/**
|
|
* Tests for bin/gstack-config bash script.
|
|
*
|
|
* Uses Bun.spawnSync to invoke the script with temp dirs and
|
|
* GSTACK_STATE_DIR env override for full isolation.
|
|
*/
|
|
|
|
import { describe, test, expect, beforeEach, afterEach } from 'bun:test';
|
|
import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from 'fs';
|
|
import { join } from 'path';
|
|
import { tmpdir } from 'os';
|
|
|
|
const SCRIPT = join(import.meta.dir, '..', '..', 'bin', 'gstack-config');
|
|
|
|
let stateDir: string;
|
|
|
|
function run(args: string[] = [], extraEnv: Record<string, string> = {}) {
|
|
const result = Bun.spawnSync(['bash', SCRIPT, ...args], {
|
|
env: {
|
|
...process.env,
|
|
GSTACK_STATE_DIR: stateDir,
|
|
...extraEnv,
|
|
},
|
|
stdout: 'pipe',
|
|
stderr: 'pipe',
|
|
});
|
|
return {
|
|
exitCode: result.exitCode,
|
|
stdout: result.stdout.toString().trim(),
|
|
stderr: result.stderr.toString().trim(),
|
|
};
|
|
}
|
|
|
|
beforeEach(() => {
|
|
stateDir = mkdtempSync(join(tmpdir(), 'gstack-config-test-'));
|
|
});
|
|
|
|
afterEach(() => {
|
|
rmSync(stateDir, { recursive: true, force: true });
|
|
});
|
|
|
|
describe('gstack-config', () => {
|
|
// ─── get ──────────────────────────────────────────────────
|
|
test('get on missing file returns empty, exit 0', () => {
|
|
const { exitCode, stdout } = run(['get', 'auto_upgrade']);
|
|
expect(exitCode).toBe(0);
|
|
expect(stdout).toBe('');
|
|
});
|
|
|
|
test('get existing key returns value', () => {
|
|
writeFileSync(join(stateDir, 'config.yaml'), 'auto_upgrade: true\n');
|
|
const { exitCode, stdout } = run(['get', 'auto_upgrade']);
|
|
expect(exitCode).toBe(0);
|
|
expect(stdout).toBe('true');
|
|
});
|
|
|
|
test('get missing key returns empty', () => {
|
|
writeFileSync(join(stateDir, 'config.yaml'), 'auto_upgrade: true\n');
|
|
const { exitCode, stdout } = run(['get', 'nonexistent']);
|
|
expect(exitCode).toBe(0);
|
|
expect(stdout).toBe('');
|
|
});
|
|
|
|
test('get returns last value when key appears multiple times', () => {
|
|
writeFileSync(join(stateDir, 'config.yaml'), 'foo: bar\nfoo: baz\n');
|
|
const { exitCode, stdout } = run(['get', 'foo']);
|
|
expect(exitCode).toBe(0);
|
|
expect(stdout).toBe('baz');
|
|
});
|
|
|
|
// ─── set ──────────────────────────────────────────────────
|
|
test('set creates file and writes key on missing file', () => {
|
|
const { exitCode } = run(['set', 'auto_upgrade', 'true']);
|
|
expect(exitCode).toBe(0);
|
|
const content = readFileSync(join(stateDir, 'config.yaml'), 'utf-8');
|
|
expect(content).toContain('auto_upgrade: true');
|
|
});
|
|
|
|
test('set appends new key to existing file', () => {
|
|
writeFileSync(join(stateDir, 'config.yaml'), 'foo: bar\n');
|
|
const { exitCode } = run(['set', 'auto_upgrade', 'true']);
|
|
expect(exitCode).toBe(0);
|
|
const content = readFileSync(join(stateDir, 'config.yaml'), 'utf-8');
|
|
expect(content).toContain('foo: bar');
|
|
expect(content).toContain('auto_upgrade: true');
|
|
});
|
|
|
|
test('set replaces existing key in-place', () => {
|
|
writeFileSync(join(stateDir, 'config.yaml'), 'auto_upgrade: false\n');
|
|
const { exitCode } = run(['set', 'auto_upgrade', 'true']);
|
|
expect(exitCode).toBe(0);
|
|
const content = readFileSync(join(stateDir, 'config.yaml'), 'utf-8');
|
|
expect(content).toContain('auto_upgrade: true');
|
|
expect(content).not.toContain('auto_upgrade: false');
|
|
});
|
|
|
|
test('set creates state dir if missing', () => {
|
|
const nestedDir = join(stateDir, 'nested', 'dir');
|
|
const { exitCode } = run(['set', 'foo', 'bar'], { GSTACK_STATE_DIR: nestedDir });
|
|
expect(exitCode).toBe(0);
|
|
expect(existsSync(join(nestedDir, 'config.yaml'))).toBe(true);
|
|
});
|
|
|
|
// ─── list ─────────────────────────────────────────────────
|
|
test('list shows all keys', () => {
|
|
writeFileSync(join(stateDir, 'config.yaml'), 'auto_upgrade: true\nupdate_check: false\n');
|
|
const { exitCode, stdout } = run(['list']);
|
|
expect(exitCode).toBe(0);
|
|
expect(stdout).toContain('auto_upgrade: true');
|
|
expect(stdout).toContain('update_check: false');
|
|
});
|
|
|
|
test('list on missing file returns empty, exit 0', () => {
|
|
const { exitCode, stdout } = run(['list']);
|
|
expect(exitCode).toBe(0);
|
|
expect(stdout).toBe('');
|
|
});
|
|
|
|
// ─── usage ────────────────────────────────────────────────
|
|
test('no args shows usage and exits 1', () => {
|
|
const { exitCode, stdout } = run([]);
|
|
expect(exitCode).toBe(1);
|
|
expect(stdout).toContain('Usage');
|
|
});
|
|
|
|
// ─── security: input validation ─────────────────────────
|
|
test('set rejects key with regex metacharacters', () => {
|
|
const { exitCode, stderr } = run(['set', '.*', 'value']);
|
|
expect(exitCode).toBe(1);
|
|
expect(stderr).toContain('alphanumeric');
|
|
});
|
|
|
|
test('set preserves value with sed special chars', () => {
|
|
run(['set', 'test_special', 'a/b&c\\d']);
|
|
const { stdout } = run(['get', 'test_special']);
|
|
expect(stdout).toBe('a/b&c\\d');
|
|
});
|
|
});
|