init project

src/lib/__tests__/sandbox.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect } from 'vitest';
+import path from 'node:path';
+import { resolveWorkspacePath, assertAllowedBinary, SandboxViolationError } from '../sandbox.js';
+
+const ROOT = path.resolve('/workspace');
+
+describe('resolveWorkspacePath', () => {
+  it('resolves a simple relative path inside the root', () => {
+    const result = resolveWorkspacePath(ROOT, 'src/index.ts');
+    expect(result).toBe(path.join(ROOT, 'src', 'index.ts'));
+  });
+
+  it('resolves "." to the root itself', () => {
+    const result = resolveWorkspacePath(ROOT, '.');
+    expect(result).toBe(ROOT);
+  });
+
+  it('throws for a single .. escape attempt', () => {
+    expect(() => resolveWorkspacePath(ROOT, '../etc/passwd')).toThrow(SandboxViolationError);
+  });
+
+  it('throws for nested .. escape attempts', () => {
+    expect(() => resolveWorkspacePath(ROOT, 'a/b/../../../../etc/passwd')).toThrow(SandboxViolationError);
+  });
+
+  it('throws for an absolute path outside the root', () => {
+    expect(() => resolveWorkspacePath(ROOT, '/etc/passwd')).toThrow(SandboxViolationError);
+  });
+
+  it('allows a path that walks up and back down inside the root', () => {
+    const result = resolveWorkspacePath(ROOT, 'a/b/../c/d.ts');
+    expect(result).toBe(path.join(ROOT, 'a', 'c', 'd.ts'));
+  });
+});
+
+describe('assertAllowedBinary', () => {
+  it('allows an explicitly listed binary', () => {
+    expect(() => assertAllowedBinary('npm')).not.toThrow();
+    expect(() => assertAllowedBinary('php')).not.toThrow();
+    expect(() => assertAllowedBinary('docker')).not.toThrow();
+  });
+
+  it('allows listed binaries with common Windows extensions', () => {
+    expect(() => assertAllowedBinary('npm.exe')).not.toThrow();
+    expect(() => assertAllowedBinary('node.cmd')).not.toThrow();
+    expect(() => assertAllowedBinary('composer.ps1')).not.toThrow();
+  });
+
+  it('allows a binary with a directory prefix', () => {
+    expect(() => assertAllowedBinary('vendor/bin/phpunit')).not.toThrow();
+  });
+
+  it('rejects a binary not on the allow-list', () => {
+    expect(() => assertAllowedBinary('rm')).toThrow(SandboxViolationError);
+    expect(() => assertAllowedBinary('curl')).toThrow(SandboxViolationError);
+  });
+
+  it('rejects a path that would execute an arbitrary binary', () => {
+    expect(() => assertAllowedBinary('/usr/bin/rm')).toThrow(SandboxViolationError);
+  });
+});