| import test from 'node:test'; |
| import assert from 'node:assert/strict'; |
| import { synthesizeAndInjectPatch } from '../dist/patch/patch_engine.js'; |
|
|
| test('Patch Engine: Rewrites vulnerable template SQL into parameterized query', () => { |
| const vuln = 'const res = await db.query(`SELECT * FROM users WHERE email = ${email} AND status = ${status}`);'; |
| const result = synthesizeAndInjectPatch({ sourceCode: vuln, filename: 'auth.ts' }); |
|
|
| assert.equal(result.applied, true); |
| assert.ok(result.patchedCode.includes("db.query('SELECT * FROM users WHERE email = $1 AND status = $2', [email, status])")); |
| assert.ok(result.diff.includes('+')); |
| }); |
|
|
| test('Patch Engine: Injects security headers into Express server setup', () => { |
| const code = ` |
| import express from 'express'; |
| const app = express(); |
| app.listen(3000); |
| `; |
| const result = synthesizeAndInjectPatch({ sourceCode: code, filename: 'server.ts' }); |
|
|
| assert.equal(result.applied, true); |
| assert.ok(result.patchedCode.includes('Content-Security-Policy')); |
| assert.ok(result.patchedCode.includes('Strict-Transport-Security')); |
| }); |
|
|
| test('Patch Engine: Sanitizes plain innerHTML assignments into textContent', () => { |
| const code = 'document.getElementById("status").innerHTML = message;'; |
| const result = synthesizeAndInjectPatch({ sourceCode: code }); |
|
|
| assert.equal(result.applied, true); |
| assert.ok(result.patchedCode.includes('.textContent = message;')); |
| }); |
|
|
