tegwick
6f1ca0bfef
Each Canon test now has a fixture-asm registration that fails known-bad and passes known-good in-process. Live asm-tNN targets stay pending. No network, OpenBao, or packet. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
60 lines
2.4 KiB
Python
60 lines
2.4 KiB
Python
import json
|
|
|
|
import pytest
|
|
|
|
from whitehat_security.asm import CALIBRATORS, asm_calibration, t06_calibration, t06_results
|
|
from whitehat_security.cli import main
|
|
|
|
|
|
def test_t06_enforcing_rejects_different_digest_without_openbao():
|
|
results = {item.probe_id: item for item in t06_results(enforce=True)}
|
|
assert results["t06-exact-consume"].outcome == "pass"
|
|
assert results["t06-different-digest-replay"].outcome == "pass"
|
|
assert results["t06-different-digest-replay"].openbao_calls == 0
|
|
|
|
|
|
def test_t06_known_bad_accepts_different_digest_and_calls_openbao():
|
|
results = {item.probe_id: item for item in t06_results(enforce=False)}
|
|
assert results["t06-different-digest-replay"].outcome == "finding"
|
|
assert results["t06-different-digest-replay"].openbao_calls == 1
|
|
|
|
|
|
def test_t06_calibration_detects_known_bad_and_keeps_token_out():
|
|
report = t06_calibration()
|
|
assert report["outcome"] == "pass"
|
|
assert report["evidence_class"] == "fixture"
|
|
assert report["test_id"] == "T-06"
|
|
rendered = json.dumps(report)
|
|
assert "whitehat-t06-synthetic" not in rendered
|
|
assert "Bearer" not in rendered
|
|
bad = {item["probe_id"]: item for item in report["known_bad"]}
|
|
assert bad["t06-different-digest-replay"]["outcome"] == "finding"
|
|
|
|
|
|
def test_asm_fixtures_cli_writes_t06(tmp_path):
|
|
output = tmp_path / "offline-asm-t06-calibration.json"
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["asm-fixtures", "--test-id", "T-06", "--output", str(output)])
|
|
assert stopped.value.code == 0
|
|
report = json.loads(output.read_text(encoding="utf-8"))
|
|
assert report["outcome"] == "pass"
|
|
assert report["test_id"] == "T-06"
|
|
|
|
|
|
@pytest.mark.parametrize("test_id", [key for key in CALIBRATORS if key != "T-06"])
|
|
def test_remaining_asm_calibrations_fail_known_bad(test_id):
|
|
report = asm_calibration(test_id)
|
|
assert report["outcome"] == "pass"
|
|
assert report["evidence_class"] == "fixture"
|
|
assert report["test_id"] == test_id
|
|
assert any(item["outcome"] == "finding" for item in report["known_bad"])
|
|
assert all(item["outcome"] == "pass" for item in report["known_good"])
|
|
blob = json.dumps(report)
|
|
assert "sk-whitehat-t02-not-a-real-secret" not in blob
|
|
assert "whitehat-t06-synthetic" not in blob
|
|
|
|
|
|
def test_asm_fixtures_cli_refuses_unknown_test():
|
|
with pytest.raises(SystemExit) as stopped:
|
|
main(["asm-fixtures", "--test-id", "T-99"])
|
|
assert stopped.value.code == 2
|