51 lines
2.4 KiB
Python
51 lines
2.4 KiB
Python
import contextlib
|
|
import io
|
|
import json
|
|
import unittest
|
|
from unittest.mock import patch
|
|
import preflight
|
|
|
|
SENTINEL='synthetic-sensitive-fixture-value'
|
|
|
|
class PreflightTests(unittest.TestCase):
|
|
def test_unrelated_protected_values_never_return(self):
|
|
result=preflight.env_predicates(('TOKEN='+SENTINEL+'\nOTHER="'+SENTINEL+'"\n').encode())
|
|
self.assertTrue(result['syntax_supported']);self.assertTrue(result['selectors_absent'])
|
|
self.assertNotIn(SENTINEL,json.dumps(result))
|
|
|
|
def test_each_selector_blocks_without_exposing_value(self):
|
|
for key in preflight.SELECTORS:
|
|
result=preflight.env_predicates((key+'='+SENTINEL).encode())
|
|
self.assertFalse(result['selectors_absent']);self.assertTrue(result['selector_presence'][key])
|
|
self.assertNotIn(SENTINEL,json.dumps(result))
|
|
|
|
def test_effective_process_values_cannot_create_fake_keys(self):
|
|
result=preflight.env_predicates(('TOKEN=x\nK3S_CONFIG_FILE='+SENTINEL+'\0').encode(),process=True)
|
|
self.assertFalse(result['syntax_supported'])
|
|
self.assertNotIn(SENTINEL,json.dumps(result))
|
|
|
|
def test_process_selector_detected(self):
|
|
result=preflight.env_predicates(b'A=x\0K3S_CONFIG_FILE=/hidden\0',process=True)
|
|
self.assertFalse(result['selectors_absent'])
|
|
|
|
def test_complex_syntax_refuses(self):
|
|
for raw in (b'export KEY=value',b'A="unterminated',b'A=x\\\ny',b'A=x\nA=y'):
|
|
self.assertFalse(preflight.env_predicates(raw)['syntax_supported'])
|
|
|
|
def test_comments_cannot_activate_selector(self):
|
|
result=preflight.env_predicates(b'# K3S_CONFIG_FILE=/ignored\n; comment\nA=x\n')
|
|
self.assertTrue(result['selectors_absent'])
|
|
|
|
def test_nonroot_refuses_before_any_files(self):
|
|
with patch.object(preflight.os,'geteuid',return_value=1000),patch.object(preflight,'read_fixed') as read:
|
|
self.assertEqual(preflight.inspect()['status'],'refused_requires_attended_root')
|
|
read.assert_not_called()
|
|
|
|
def test_exception_text_never_emitted(self):
|
|
output=io.StringIO()
|
|
with patch.object(preflight,'inspect',side_effect=ValueError(SENTINEL)),contextlib.redirect_stdout(output):
|
|
self.assertEqual(preflight.main(),1)
|
|
self.assertNotIn(SENTINEL,output.getvalue())
|
|
self.assertFalse(json.loads(output.getvalue())['passed'])
|
|
|
|
if __name__=='__main__':unittest.main()
|