security_test.go

package main

import (
	"strings"
	"testing"

	"github.com/rs/zerolog"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestSecurityValidator_validateCommand(t *testing.T) {
	logger := zerolog.New(zerolog.NewTestWriter(t))

	tests := []struct {
		name          string
		config        SecurityConfig
		command       string
		expectError   bool
		errorContains string
	}{
		{
			name: "security disabled allows everything",
			config: SecurityConfig{
				Enabled: false,
			},
			command:     "rm -rf /",
			expectError: false,
		},
		{
			name: "secure mode with allowed executables - allows ls",
			config: SecurityConfig{
				Enabled:            true,
				UseShellExecution:  false,
				AllowedExecutables: []string{"ls", "pwd", "echo"},
			},
			command:     "ls -la",
			expectError: false,
		},
		{
			name: "secure mode with allowed executables - blocks rm",
			config: SecurityConfig{
				Enabled:            true,
				UseShellExecution:  false,
				AllowedExecutables: []string{"ls", "pwd", "echo"},
			},
			command:       "rm -rf /",
			expectError:   true,
			errorContains: "not in allowed list",
		},
		{
			name: "secure mode with no allowed executables - blocks everything",
			config: SecurityConfig{
				Enabled:           true,
				UseShellExecution: false,
			},
			command:       "echo hello",
			expectError:   true,
			errorContains: "no allowed executables configured",
		},
		{
			name: "legacy mode with allowed commands - allows echo",
			config: SecurityConfig{
				Enabled:           true,
				UseShellExecution: true,
				AllowedCommands:   []string{"echo", "ls"},
			},
			command:     "echo hello",
			expectError: false,
		},
		{
			name: "legacy mode with allowed commands - blocks rm",
			config: SecurityConfig{
				Enabled:           true,
				UseShellExecution: true,
				AllowedCommands:   []string{"echo", "ls"},
			},
			command:       "rm file",
			expectError:   true,
			errorContains: "not in allowed list",
		},
		{
			name: "legacy mode with blocked commands - blocks rm",
			config: SecurityConfig{
				Enabled:           true,
				UseShellExecution: true,
				BlockedCommands:   []string{"rm", "chmod", "sudo"},
			},
			command:       "rm file",
			expectError:   true,
			errorContains: "blocked keyword",
		},
		{
			name: "legacy mode with blocked patterns - blocks rm -rf",
			config: SecurityConfig{
				Enabled:           true,
				UseShellExecution: true,
				BlockedPatterns:   []string{"rm\\s+-rf", "sudo\\s+"},
			},
			command:       "rm -rf /tmp",
			expectError:   true,
			errorContains: "blocked pattern",
		},
		// Issue #7: blocked_patterns in secure mode
		{
			name: "secure mode with blocked_patterns - blocks git remote -v",
			config: SecurityConfig{
				Enabled:            true,
				UseShellExecution:  false,
				AllowedExecutables: []string{"git"},
				BlockedPatterns:    []string{`(^|\s)remote\s+(-v|--verbose)(\s|$)`},
			},
			command:       "git remote -v",
			expectError:   true,
			errorContains: "blocked pattern",
		},
		{
			name: "secure mode with blocked_patterns - allows git status",
			config: SecurityConfig{
				Enabled:            true,
				UseShellExecution:  false,
				AllowedExecutables: []string{"git"},
				BlockedPatterns:    []string{`(^|\s)remote\s+(-v|--verbose)(\s|$)`},
			},
			command:     "git status",
			expectError: false,
		},
		{
			name: "secure mode with blocked_commands - blocks rm in allowed ls",
			config: SecurityConfig{
				Enabled:            true,
				UseShellExecution:  false,
				AllowedExecutables: []string{"ls", "rm"},
				BlockedCommands:    []string{"rm -rf"},
			},
			command:       "rm -rf /tmp",
			expectError:   true,
			errorContains: "blocked keyword",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			validator := newSecurityValidator(tt.config, logger)
			err := validator.validateCommand(tt.command)

			if tt.expectError {
				require.Error(t, err)
				if tt.errorContains != "" {
					assert.Contains(t, err.Error(), tt.errorContains)
				}
			} else {
				require.NoError(t, err)
			}
		})
	}
}

func TestSecurityValidator_validateExecutableCommand(t *testing.T) {
	logger := zerolog.New(zerolog.NewTestWriter(t))

	tests := []struct {
		name              string
		allowedExecutables []string
		command           string
		expectError       bool
		errorContains     string
	}{
		{
			name:               "simple command in allowlist",
			allowedExecutables: []string{"ls", "pwd", "echo"},
			command:            "ls -la",
			expectError:        false,
		},
		{
			name:               "command not in allowlist",
			allowedExecutables: []string{"ls", "pwd", "echo"},
			command:            "rm file.txt",
			expectError:        true,
			errorContains:      "not in allowed list",
		},
		{
			name:               "absolute path exact match",
			allowedExecutables: []string{"/usr/bin/git", "/bin/ls"},
			command:            "/usr/bin/git status",
			expectError:        false,
		},
		{
			name:               "absolute path mismatch",
			allowedExecutables: []string{"/usr/bin/git"},
			command:            "/bin/git status",
			expectError:        true,
			errorContains:      "not in allowed list",
		},
		{
			name:               "empty command",
			allowedExecutables: []string{"ls"},
			command:            "",
			expectError:        true,
			errorContains:      "empty command",
		},
		{
			name:               "whitespace only command",
			allowedExecutables: []string{"ls"},
			command:            "   ",
			expectError:        true,
			errorContains:      "empty command",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			config := SecurityConfig{
				AllowedExecutables: tt.allowedExecutables,
			}
			validator := newSecurityValidator(config, logger)
			err := validator.validateExecutableCommand(tt.command)

			if tt.expectError {
				require.Error(t, err)
				if tt.errorContains != "" {
					assert.Contains(t, err.Error(), tt.errorContains)
				}
			} else {
				require.NoError(t, err)
			}
		})
	}
}

func TestSecurityValidator_matchesExecutable(t *testing.T) {
	logger := zerolog.New(zerolog.NewTestWriter(t))
	validator := newSecurityValidator(SecurityConfig{}, logger)

	tests := []struct {
		name       string
		executable string
		pattern    string
		expected   bool
	}{
		{
			name:       "exact match",
			executable: "ls",
			pattern:    "ls",
			expected:   true,
		},
		{
			name:       "no match",
			executable: "ls",
			pattern:    "rm",
			expected:   false,
		},
		{
			name:       "absolute path exact match",
			executable: "/usr/bin/git",
			pattern:    "/usr/bin/git",
			expected:   true,
		},
		{
			name:       "basename match for command in PATH",
			executable: "git",
			pattern:    "git",
			expected:   true, // This should work if git is in PATH
		},
		{
			name:       "absolute path vs basename no match",
			executable: "/usr/bin/git",
			pattern:    "git",
			expected:   false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			result := validator.matchesExecutable(tt.executable, tt.pattern)
			assert.Equal(t, tt.expected, result)
		})
	}
}

func TestSecurityValidator_validateLegacyCommand(t *testing.T) {
	logger := zerolog.New(zerolog.NewTestWriter(t))

	tests := []struct {
		name            string
		config          SecurityConfig
		command         string
		expectError     bool
		errorContains   string
	}{
		{
			name: "no restrictions - allows everything",
			config: SecurityConfig{
				AllowedCommands: []string{},
				BlockedCommands: []string{},
				BlockedPatterns: []string{},
			},
			command:     "any command here",
			expectError: false,
		},
		{
			name: "blocked command keyword",
			config: SecurityConfig{
				BlockedCommands: []string{"rm", "chmod"},
			},
			command:       "rm -rf /",
			expectError:   true,
			errorContains: "blocked keyword",
		},
		{
			name: "blocked pattern match",
			config: SecurityConfig{
				BlockedPatterns: []string{"rm\\s+-rf"},
			},
			command:       "rm -rf /tmp",
			expectError:   true,
			errorContains: "blocked pattern",
		},
		{
			name: "allowed command prefix match",
			config: SecurityConfig{
				AllowedCommands: []string{"echo", "ls -"},
			},
			command:     "echo hello world",
			expectError: false,
		},
		{
			name: "command not in allowed list",
			config: SecurityConfig{
				AllowedCommands: []string{"echo", "ls"},
			},
			command:       "rm file",
			expectError:   true,
			errorContains: "not in allowed list",
		},
		{
			name: "complex injection attempt blocked by keyword",
			config: SecurityConfig{
				BlockedCommands: []string{"chmod"},
			},
			command:       "chmod 777 /etc/passwd",
			expectError:   true,
			errorContains: "blocked keyword",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			validator := newSecurityValidator(tt.config, logger)
			err := validator.validateLegacyCommand(tt.command)

			if tt.expectError {
				require.Error(t, err)
				if tt.errorContains != "" {
					assert.Contains(t, err.Error(), tt.errorContains)
				}
			} else {
				require.NoError(t, err)
			}
		})
	}
}

func TestSecurityValidator_vulnerability_scenarios(t *testing.T) {
	logger := zerolog.New(zerolog.NewTestWriter(t))

	// Test scenarios based on the VULN.md report
	vulnerabilityPayloads := []struct {
		name        string
		command     string
		description string
	}{
		{
			name:        "VULN.md example",
			command:     "echo $($(echo -n c; echo -n h; echo -n m; echo -n o; echo -n d))",
			description: "Obfuscated chmod reconstruction",
		},
		{
			name:        "simple command injection",
			command:     "ls; rm -rf /",
			description: "Command separator injection",
		},
		{
			name:        "pipe injection",
			command:     "echo safe | rm dangerous",
			description: "Pipe-based command injection",
		},
		{
			name:        "background injection",
			command:     "echo safe & rm dangerous",
			description: "Background process injection",
		},
	}

	t.Run("secure_mode_blocks_all_vulnerabilities", func(t *testing.T) {
		config := SecurityConfig{
			Enabled:            true,
			UseShellExecution:  false,
			AllowedExecutables: []string{"echo", "ls"}, // Only safe commands
		}
		validator := newSecurityValidator(config, logger)

		for _, payload := range vulnerabilityPayloads {
			t.Run(payload.name, func(t *testing.T) {
				err := validator.validateCommand(payload.command)
				if err != nil {
					assert.Error(t, err, "Secure mode should block: %s", payload.description)
					// Check for either error message since they both indicate blocking
					errorMsg := err.Error()
					shouldContainOne := strings.Contains(errorMsg, "not in allowed list") ||
						strings.Contains(errorMsg, "shell metacharacters") ||
						strings.Contains(errorMsg, "dangerous shell constructs")
					assert.True(t, shouldContainOne, "Error should indicate blocking: %s", errorMsg)
				} else {
					t.Errorf("Secure mode should block: %s", payload.description)
				}
			})
		}
	})

	t.Run("legacy_mode_with_proper_blocks", func(t *testing.T) {
		config := SecurityConfig{
			Enabled:           true,
			UseShellExecution: true,
			BlockedCommands:   []string{"rm", "chmod", "chown", "sudo"},
			BlockedPatterns:   []string{"rm\\s+-rf", "chmod\\s+"},
		}
		validator := newSecurityValidator(config, logger)

		// The VULN.md example demonstrates the vulnerability - obfuscated commands bypass keyword matching
		err := validator.validateCommand("echo $($(echo -n c; echo -n h; echo -n m; echo -n o; echo -n d))")
		// This should pass because "chmod" doesn't appear literally in the command
		assert.NoError(t, err, "Legacy mode cannot detect obfuscated commands")

		// But a simple rm should be blocked
		err = validator.validateCommand("rm file")
		assert.Error(t, err)
		assert.Contains(t, err.Error(), "blocked keyword")
	})

	t.Run("legacy_mode_vulnerable_without_proper_blocks", func(t *testing.T) {
		config := SecurityConfig{
			Enabled:           true,
			UseShellExecution: true,
			// No blocks configured - vulnerable
		}
		validator := newSecurityValidator(config, logger)

		// All payloads would pass validation (but still be dangerous)
		for _, payload := range vulnerabilityPayloads {
			t.Run(payload.name, func(t *testing.T) {
				err := validator.validateCommand(payload.command)
				assert.NoError(t, err, "Legacy mode without blocks allows: %s", payload.description)
			})
		}
	})
}