37 lines
1.6 KiB
Python
37 lines
1.6 KiB
Python
"""The referenced-script walk sees the same inert-heredoc-masked view as the direct scan (#110422).
|
|
|
|
``_direct_lifecycle_scan`` masks provably-inert heredoc bodies (quoted delimiter, allowlisted
|
|
data consumer such as ``python3 - <<'PY'``), but ``_contains_unsafe_gateway_action`` walked
|
|
referenced scripts and ``sh -c`` payloads on the raw command, so a >1 MiB data path mentioned
|
|
inside the Python body failed closed as an oversized "script".
|
|
"""
|
|
|
|
from cron.lifecycle_guard import contains_gateway_lifecycle_command_or_referenced_script as guard
|
|
|
|
|
|
def _big_file(tmp_path):
|
|
path = tmp_path / "big_blob.bin"
|
|
path.write_bytes(b"\0" * (2 * 1024 * 1024))
|
|
return path
|
|
|
|
|
|
def test_inert_heredoc_body_path_not_walked_as_script(tmp_path):
|
|
big = _big_file(tmp_path)
|
|
command = f"python3 - <<'PY'\nfrom pathlib import Path\nprint(Path('{big}').stat().st_size)\nPY"
|
|
assert guard(command, cwd=str(tmp_path)) is False
|
|
|
|
|
|
def test_unquoted_heredoc_body_path_still_walked(tmp_path):
|
|
"""An expansion-capable body is not provably inert: the walk still sees it and fails closed."""
|
|
big = _big_file(tmp_path)
|
|
assert guard(f"cat > /tmp/x <<EOF\n{big}\nEOF", cwd=str(tmp_path)) is True
|
|
|
|
|
|
def test_inert_heredoc_body_script_path_still_read(tmp_path):
|
|
"""Masking hides the body from the *executed* view only: a lifecycle script named inside a
|
|
Python body is still handed to ``os.system`` at runtime, so its contents must still be read."""
|
|
script = tmp_path / "restart.sh"
|
|
script.write_text("#!/bin/sh\nhermes gateway restart\n")
|
|
command = f"python3 - <<'PY'\nimport os\nos.system('{script}')\nPY"
|
|
assert guard(command, cwd=str(tmp_path)) is True
|