vulnerability-analysis.spec.ts

import { describe, expect, it } from 'vitest';

import { parseArgv, type VulnerabilityCategory } from '../';
import { noVulnerabilities, oneVulnerability } from './__fixtures__/mocks';

describe('VulnerabilityAnalysis', () => {
   describe('permitted settings', () => {
      it.skip.each<[string, string]>([
         ['alias.status', 'safe'],
         ['core.fsmonitor', 'false'],
         ['core.gitproxy', 'none'],
         ['credential.helper', 'osxkeychain'],
      ])('allows writing %s = %s to the git config', (key, value) => {
         expect(parseArgv('config', key, value)).toHaveProperty(
            'vulnerabilities',
            noVulnerabilities()
         );
      });

      it('allows local cloning', () => {
         const parsed = parseArgv('clone', '--no-checkout', '--', './first', 'second');
         expect(parsed.vulnerabilities).toEqual(noVulnerabilities());
      });

      it('allows local cloning without checkout', () => {
         const parsed = parseArgv('clone', '--no-checkout', '--', './first', 'second');
         expect(parsed.vulnerabilities).toEqual(noVulnerabilities());
      });

      it('clone non-default branch is allowed (#1137)', async () => {
         const parsed = parseArgv(
            'clone',
            '-b',
            'non-default-branch',
            '--',
            'https://github.com/example/bruno.git',
            '/tmp/target'
         );
         expect(parsed.vulnerabilities).toEqual(noVulnerabilities());
      });

      it('allows -u for non-clone commands', async () => {
         const parsed = parseArgv('push', '-u', 'origin/main');
         expect(parsed.vulnerabilities).toEqual(noVulnerabilities());
      });

      it('uses pathspec protection for -u in remote', async () => {
         const parsed = parseArgv('clone', '--', '-u touch /tmp/pwn', 'file:///tmp/zero12');
         expect(parsed.vulnerabilities).toEqual(noVulnerabilities());
      });
   });

   it.each<[string, string, VulnerabilityCategory | null]>([
      ['alias.status', '!malicious', 'allowUnsafeAlias'],
      ['core.askPass', '!malicious', 'allowUnsafeAskPass'],
      ['core.editor', 'malicious', 'allowUnsafeEditor'],
      ['core.fsmonitor', 'malicious', 'allowUnsafeFsMonitor'],
      ['core.gitproxy', 'malicious', 'allowUnsafeGitProxy'],
      ['core.hooksPath', '/malicious', 'allowUnsafeHooksPath'],
      ['core.pager', 'malicious', 'allowUnsafePager'],
      ['core.sshCommand', 'malicious', 'allowUnsafeSshCommand'],
      ['credential.helper', '/tmp/evil', 'allowUnsafeCredentialHelper'],
      ['credential.https://example.com.helper', '!malicious', 'allowUnsafeCredentialHelper'],
      ['credential.helper', '!malicious', 'allowUnsafeCredentialHelper'],
      ['diff.command', 'malicious', 'allowUnsafeDiffExternal'],
      ['diff.driver.command', 'malicious', 'allowUnsafeDiffExternal'],
      ['diff.external', 'malicious', 'allowUnsafeDiffExternal'],
      ['difftool.vimdiff.cmd', 'malicious', 'allowUnsafeDiffExternal'],
      ['diff.textconv', 'malicious', 'allowUnsafeDiffTextConv'],
      ['diff.driver.textconv', 'malicious', 'allowUnsafeDiffTextConv'],
      ['filter.clean', 'malicious', 'allowUnsafeFilter'],
      ['filter.driver.clean', 'malicious', 'allowUnsafeFilter'],
      ['filter.lfs.process', 'malicious', 'allowUnsafeFilter'],
      ['filter.smudge', 'malicious', 'allowUnsafeFilter'],
      ['filter.driver.smudge', 'malicious', 'allowUnsafeFilter'],
      ['gpg.program', 'malicious', 'allowUnsafeGpgProgram'],
      ['gpg.type.program', 'malicious', 'allowUnsafeGpgProgram'],
      ['include.path', '/tmp/evil.gitconfig', 'allowUnsafeInclude'],
      ['includeIf.gitdir:/**.path', '/tmp/evil.gitconfig', 'allowUnsafeInclude'],
      ['init.templateDir', '/tmp/evil', 'allowUnsafeTemplateDir'],
      ['pager.log', 'malicious', 'allowUnsafePager'],
      ['pager.log.color', 'malicious', 'allowUnsafePager'],
      ['merge.driver', '/tmp/evil', 'allowUnsafeMergeDriver'],
      ['merge.foo.driver', '/tmp/evil', 'allowUnsafeMergeDriver'],
      ['mergetool.path', '/tmp/evil', 'allowUnsafeMergeDriver'],
      ['mergetool.foo.path', '/tmp/evil', 'allowUnsafeMergeDriver'],
      ['mergetool.cmd', '/tmp/evil', 'allowUnsafeMergeDriver'],
      ['mergetool.foo.cmd', '/tmp/evil', 'allowUnsafeMergeDriver'],
      ['remote.receivepack', 'malicious', 'allowUnsafePack'],
      ['remote.https://example.com.receivepack', 'malicious', 'allowUnsafePack'],
      ['remote.uploadpack', 'malicious', 'allowUnsafePack'],
      ['remote.https://example.com.uploadpack', 'malicious', 'allowUnsafePack'],
      ['uploadpack.packObjectsHook', 'malicious', 'allowUnsafePack'],
      ['sequence.editor', 'malicious', 'allowUnsafeEditor'],
      ['submodule.evil.update', '!malicious', 'allowUnsafeSubmodule'],
      ['tar.command', '!malicious', 'allowUnsafeCommandBinaries'],
      ['tar.foo.command', '!malicious', 'allowUnsafeCommandBinaries'],
      ['trailer.foo.command', '!malicious', 'allowUnsafeCommandBinaries'],
      ['trailer.foo.cmd', '!malicious', 'allowUnsafeCommandBinaries'],
      ['trailer.cmd', '!malicious', 'allowUnsafeCommandBinaries'],
      ['url.https://evil.com.insteadOf', 'https://github.com', 'allowUnsafeUrlRewrite'],
      ['url.https://evil.com.insteadOf', 'git@github.com:', 'allowUnsafeUrlRewrite'],
   ])('writing %s = %s to the git config', (key, value, category) => {
      const expected = category ? oneVulnerability(category) : noVulnerabilities();

      // writing local config
      expect(parseArgv('config', key, value).vulnerabilities).toEqual(expected);

      // trailing inline config
      expect(
         parseArgv('clone', 'remote', 'local', '-c', `${key}=${value}`).vulnerabilities
      ).toEqual(expected);

      // leading inline config
      expect(
         parseArgv('-c', `${key}=${value}`, 'clone', 'remote', 'local').vulnerabilities
      ).toEqual(expected);
   });

   it.each([
      ['protocol.allow=always'],
      ['PROTOCOL.ALLOW=always'],
      ['Protocol.Allow=always'],
      ['PROTOCOL.allow=always'],
      ['protocol.ALLOW=always'],
      ['protocol.ssh.ALLOW=always'],
      ['protocol.ext.allow=always'],
      ['protocol.git.ALLOW=never'],
   ])('Case insensitive configuration captures protocol.allow in format "%s"', async (cmd) => {
      const parsed = parseArgv('config', '-c', cmd, 'config', '--list');
      expect(parsed.vulnerabilities).toEqual(oneVulnerability('allowUnsafeProtocolOverride'));

      expect(parseArgv('-c', cmd, 'init').vulnerabilities).toEqual(
         oneVulnerability('allowUnsafeProtocolOverride')
      );
   });

   it.each([
      ['clone', '-u touch /tmp/pwn'],
      ['cmd', '--upload-pack=touch /tmp/pwn0'],
      ['cmd', '--receive-pack=touch /tmp/pwn1'],
      ['push', '--exec=touch /tmp/pwn2'],
      ['pull', '--upload-pack=touch /tmp/pwn0'],
   ])('detects upload-pack for task %s in format %s', async (cmd, option) => {
      const parsed = parseArgv(cmd, option);
      expect(parsed.vulnerabilities).toEqual(oneVulnerability('allowUnsafePack'));
   });

   it.each<[VulnerabilityCategory, string]>([
      ['allowUnsafeDiffExternal', `diff.external=sh -c 'id > pwned'`],
      ['allowUnsafeDiffTextConv', `diff.evil.textconv=touch /tmp/proof`],
      ['allowUnsafeDiffExternal', `diff.evil.command=sh -c 'id > pwned'`],
      ['allowUnsafeFilter', `filter.evil.clean=touch /tmp/proof`],
      ['allowUnsafeFilter', `filter.evil.smudge=touch /tmp/proof`],
      ['allowUnsafeGitProxy', `core.gitProxy=sh -c 'id > pwned'`],
      ['allowUnsafeGpgProgram', `gpg.program=malicious`],
      ['allowUnsafeGpgProgram', `gpg.ssh.program=malicious`],
      ['allowUnsafeGpgProgram', `gpg.x509.program=malicious`],
      ['allowUnsafePack', `remote.origin.uploadpack=malicious`],
      ['allowUnsafePack', `remote.origin.receivepack=malicious`],
      ['allowUnsafeHooksPath', `core.hooksPath=sh -c 'id > pwned'`],
      ['allowUnsafeFsMonitor', `core.FsMonitor=CMD`],
      ['allowUnsafeSshCommand', `core.sshCommand=sh -c 'id > pwned'`],
   ])('unsafe config option - %s', (setting, command) => {
      const expected = oneVulnerability(setting);

      expect(parseArgv('clone', 'remote', 'local', '-c', command).vulnerabilities).toEqual(
         expected
      );

      expect(parseArgv('-c', command, 'clone', 'remote', 'local').vulnerabilities).toEqual(
         expected
      );
   });

   describe.each([
      ['-', true],
      ['4', false],
      ['6', false],
      ['v', false],
      ['q', false],
      ['n', false],
      ['l', false],
   ])('detects clone -u alongside %s', (str, prefix) => {
      it('prefixing the -u', () => {
         expect(parseArgv('clone', `${str}-u`, `sh -c "touch /tmp/pwn0"`).vulnerabilities).toEqual(
            prefix ? oneVulnerability('allowUnsafePack') : noVulnerabilities()
         );
      });
      it('between the - and u', () => {
         expect(parseArgv('clone', `-${str}u`, `sh -c "touch /tmp/pwn0"`).vulnerabilities).toEqual(
            oneVulnerability('allowUnsafePack')
         );
      });
      it('suffixing the -u', () => {
         expect(parseArgv('clone', `-u${str}`, `sh -c "touch /tmp/pwn0"`).vulnerabilities).toEqual(
            oneVulnerability('allowUnsafePack')
         );
      });
   });
   describe('path-taking global flags', () => {
      it.each<[string, VulnerabilityCategory]>([
         ['--exec-path', 'allowUnsafeExec'],
         ['--git-dir', 'allowUnsafeConfigPaths'],
         ['--work-tree', 'allowUnsafeConfigPaths'],
      ])('detects %s supplied with a value', (flag, category) => {
         const expected = oneVulnerability(category);

         expect(parseArgv(`${flag}=/tmp/evil`, 'ls-remote', 'url').vulnerabilities).toEqual(
            expected
         );
         expect(parseArgv(flag, '/tmp/evil', 'ls-remote', 'url').vulnerabilities).toEqual(expected);
      });

      it('detects -C supplied with a value', () => {
         expect(parseArgv('-C', '/tmp/evil', 'ls-remote', 'url').vulnerabilities).toEqual(
            oneVulnerability('allowUnsafeConfigPaths')
         );
      });

      it.each([['--exec-path'], ['--git-dir'], ['--work-tree']])(
         'allows %s as a getter, where no value is consumed',
         (flag) => {
            expect(parseArgv('rev-parse', flag).vulnerabilities).toEqual(noVulnerabilities());
         }
      );

      it.each([
         ['apply', '-C', '3'],
         ['commit', '-C', 'HEAD~1'],
      ])('allows %s %s as a task option', (task, flag, value) => {
         expect(parseArgv(task, flag, value).vulnerabilities).toEqual(noVulnerabilities());
      });

      it('does not confuse -C with the inline config -c', () => {
         expect(parseArgv('-c', 'user.name=bob', 'status').vulnerabilities).toEqual(
            noVulnerabilities()
         );
      });
   });
});