FilesExpand file tree

main

/

ast_threat_policy_test.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

74 lines (68 loc) · 2.89 KB

main

/

ast_threat_policy_test.go

Copy path

Top

File metadata and controls

• Code
• Blame

74 lines (68 loc) · 2.89 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

//go:build !integration

package workflow

import (

"context"

"path/filepath"

"testing"

"github.com/github/gh-aw/pkg/workflow/aw"

workflowlint "github.com/github/gh-aw/pkg/workflow/lint"

"github.com/stretchr/testify/assert"

"github.com/stretchr/testify/require"

)

func TestCheckoutLintSourceToCompiler(t *testing.T) {

const trigger = "on: {pull_request_target: {acknowledge-risk: true}}\n"

const allow = "on: {pull_request_target: {acknowledge-risk: true, allowed-checkouts: [{repository: Owner/Repo, ref: main}]}}\n"

for _, tt := range []struct {

name, fields string

unsafe bool

}{

{"disabled", trigger + "checkout: false\n", false},

{"base default", trigger + "checkout: {}\n", false},

{"base sha", trigger + "checkout: {ref: '${{ github.event.pull_request.base.sha }}'}\n", false},

{"allowed literal", allow + "checkout: {repository: Owner/Repo, ref: main}\n", false},

{"head sha", trigger + "checkout: {ref: '${{ github.event.pull_request.head.sha }}'}\n", true},

{"base fetch", trigger + "checkout: {fetch: [main]}\n", true},

{"case mismatch", allow + "checkout: {repository: owner/repo, ref: main}\n", true},

{"allowed fetch", allow + "checkout: {repository: Owner/Repo, ref: main, fetch: [main]}\n", true},

{"allowed wiki", allow + "checkout: {repository: Owner/Repo, ref: main, wiki: true}\n", true},

} {

t.Run(tt.name, func(t *testing.T) {

document, err := aw.Parse("---\nengine: copilot\npermissions: {contents: read}\n" + tt.fields + "---\nPublic prompt.\n")

require.NoError(t, err)

runner, err := workflowlint.Default().Select("pull-request-target-checkout")

require.NoError(t, err)

diagnostics, err := runner.Run(context.Background(), workflowlint.Input{Document: document})

require.NoError(t, err)

assert.Equal(t, tt.unsafe, len(diagnostics) > 0)

compiler := NewCompiler(WithNoEmit(true))

data, err := compiler.ParseWorkflowDocument(document, filepath.Join(t.TempDir(), "checkout.md"))

require.NoError(t, err, "fixtures must pass the actual authored schema")

_, err = compiler.CompileToYAML(data, "checkout.md")

if tt.unsafe {

require.ErrorContains(t, err, "extremely insecure")

} else {

require.NoError(t, err, "lint remedies must compile")

}

})

}

}

func TestPromptLintCompilerPolicy(t *testing.T) {

for _, tt := range []struct {

prompt string

unsafe bool

}{

{"Repository: ${{ github.repository }}", false},

{"${{\n github.repository\n}}", true},

{"${{ env.CONFIG.constructor }}", true},

{"${{ env.CONFIG['__proto__'] }}", true},

} {

t.Run(tt.prompt, func(t *testing.T) {

document, err := aw.Parse(tt.prompt)

require.NoError(t, err)

diagnostics, err := workflowlint.PromptExpressionRule().Check(context.Background(), workflowlint.Input{Document: document})

require.NoError(t, err)

assert.Equal(t, tt.unsafe, len(diagnostics) > 0)

assert.Equal(t, tt.unsafe, validateExpressionSafety(tt.prompt) != nil)

})

}

}