File size: 4,008 Bytes
7a1ad33 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 | /**
* @license
* Copyright 2026 Google LLC
* SPDX-License-Identifier: Apache-2.0
*/
import { describe, expect, it } from 'vitest';
import { isKnownSafeCommand, isDangerousCommand } from './commandSafety.js';
describe('Windows commandSafety', () => {
describe('isKnownSafeCommand', () => {
it('should identify known safe commands', () => {
expect(isKnownSafeCommand(['dir'])).toBe(true);
expect(isKnownSafeCommand(['echo', 'hello'])).toBe(true);
expect(isKnownSafeCommand(['whoami'])).toBe(true);
});
it('should strip .exe extension for safe commands', () => {
expect(isKnownSafeCommand(['dir.exe'])).toBe(true);
expect(isKnownSafeCommand(['ECHO.EXE', 'hello'])).toBe(true);
expect(isKnownSafeCommand(['WHOAMI.exe'])).toBe(true);
});
it('should reject unknown commands', () => {
expect(isKnownSafeCommand(['unknown'])).toBe(false);
expect(isKnownSafeCommand(['npm', 'install'])).toBe(false);
});
it('should reject safe commands when effectiveCwd is outside workspace', () => {
expect(isKnownSafeCommand(['dir'], 'C:\\Windows', 'C:\\workspace')).toBe(
false,
);
});
it('should reject file-reading commands with options pointing outside workspace', () => {
expect(
isKnownSafeCommand(
['findstr', '/F:C:\\Windows\\win.ini', 'foo'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
expect(
isKnownSafeCommand(
['findstr', '/F:subdir\\..\\..\\outside\\win.ini', 'foo'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
expect(
isKnownSafeCommand(
['dir', '/Windows/win.ini'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
expect(
isKnownSafeCommand(
['dir', '/windows'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
expect(
isKnownSafeCommand(
['sort', 'C:\\Windows\\win.ini'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
});
it('should reject cd with switches escaping workspace and bare cd escaping', () => {
expect(
isKnownSafeCommand(
['cd', '-Path', '..\\outside'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
expect(
isKnownSafeCommand(
['cd', '/windows'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(false);
expect(isKnownSafeCommand(['cd'], 'C:\\workspace', 'C:\\workspace')).toBe(
false,
);
});
it('should allow file-reading commands with valid switches', () => {
expect(
isKnownSafeCommand(['dir', '/B'], 'C:\\workspace', 'C:\\workspace'),
).toBe(true);
expect(
isKnownSafeCommand(['findstr', '/s'], 'C:\\workspace', 'C:\\workspace'),
).toBe(true);
expect(
isKnownSafeCommand(
['sort', '-nonExistentFlag'],
'C:\\workspace',
'C:\\workspace',
),
).toBe(true);
});
});
describe('isDangerousCommand', () => {
it('should identify dangerous commands', () => {
expect(isDangerousCommand(['del', 'file.txt'])).toBe(true);
expect(isDangerousCommand(['powershell', '-Command', 'echo'])).toBe(true);
expect(isDangerousCommand(['cmd', '/c', 'dir'])).toBe(true);
});
it('should strip .exe extension for dangerous commands', () => {
expect(isDangerousCommand(['del.exe', 'file.txt'])).toBe(true);
expect(isDangerousCommand(['POWERSHELL.EXE', '-Command', 'echo'])).toBe(
true,
);
expect(isDangerousCommand(['cmd.exe', '/c', 'dir'])).toBe(true);
});
it('should not flag safe commands as dangerous', () => {
expect(isDangerousCommand(['dir'])).toBe(false);
expect(isDangerousCommand(['echo', 'hello'])).toBe(false);
});
});
});
|