mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-10 23:19:09 +02:00
fa4e4c3f2c
icacls '/inheritance:r /grant:r' can partially fail on localized or domain accounts: inheritance strips but the user grant doesn't resolve, leaving a machine-SID-only DACL the owner can't even list — the sidebar/PTY failure chain in #1605, caused by the very hardening call meant to protect the dir. mkdirSecure now verifies listability after hardening (a real readdir — fs.accessSync doesn't consult NTFS ACLs) and repairs via icacls /reset, re-hardens, and if hardening breaks access again leaves inherited ACLs: functional-but-unhardened beats hardened-but-unusable. The icacls calls carry windowsHide (#1835's last two sites) and the fork's static spawn-hide tripwire lands here, pinning every covered site. file-permissions.test.ts is already in the windows-free-tests curated shard, so the DACL contract executes on windows-latest. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
56 lines
2.2 KiB
TypeScript
56 lines
2.2 KiB
TypeScript
/**
|
|
* Static tripwire for #1835: child spawns reachable on Windows must pass
|
|
* windowsHide, or every daemon relaunch / taskkill / icacls / powershell
|
|
* invocation flashes a black console window (and can steal focus).
|
|
*
|
|
* Source-level, same style as server-auth.test.ts / cdp-session-cleanup.test.ts:
|
|
* cheap, deterministic, runs on every platform.
|
|
*/
|
|
|
|
import { describe, expect, test } from 'bun:test';
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
|
|
const SRC = (f: string) => fs.readFileSync(path.join(import.meta.dir, '../src', f), 'utf-8');
|
|
|
|
/** Every occurrence of `needle` in `src` must have `windowsHide` within the
|
|
* next `window` chars (the spawn's options object). */
|
|
function expectHideNearEvery(src: string, needle: string, window = 400): void {
|
|
let idx = src.indexOf(needle);
|
|
expect(idx).toBeGreaterThanOrEqual(0);
|
|
while (idx !== -1) {
|
|
const slice = src.slice(idx, idx + window);
|
|
expect(slice).toMatch(/windowsHide:\s*true/);
|
|
idx = src.indexOf(needle, idx + needle.length);
|
|
}
|
|
}
|
|
|
|
describe('windowsHide on Windows-reachable spawns (#1835)', () => {
|
|
test('daemon launch paths in cli.ts pass windowsHide', () => {
|
|
const cli = SRC('cli.ts');
|
|
// Installed path: node -e launcher — both the outer spawnSync and the
|
|
// inner detached daemon spawn (inside the launcher code string).
|
|
expect(cli).toContain('detached:true,windowsHide:true');
|
|
expectHideNearEvery(cli, "'-e', launcherCode]");
|
|
// Dev fallback: detached bun spawn.
|
|
expectHideNearEvery(cli, "nodeSpawn('bun'");
|
|
// taskkill (killServer).
|
|
expectHideNearEvery(cli, "'taskkill'");
|
|
});
|
|
|
|
test('Windows-only process probes pass windowsHide', () => {
|
|
// tasklist in isProcessAlive — runs in polling loops.
|
|
expectHideNearEvery(SRC('error-handling.ts'), "'tasklist'");
|
|
// powershell DPAPI + tasklist in cookie import.
|
|
const cookie = SRC('cookie-import-browser.ts');
|
|
expectHideNearEvery(cookie, "'powershell'");
|
|
expectHideNearEvery(cookie, "'tasklist'");
|
|
});
|
|
|
|
test('icacls calls in file-permissions.ts pass windowsHide', () => {
|
|
const perms = SRC('file-permissions.ts');
|
|
expect((perms.match(/'icacls'/g) || []).length).toBeGreaterThanOrEqual(3);
|
|
expectHideNearEvery(perms, "'icacls'");
|
|
});
|
|
});
|