Quellcode-Bibliothek audit-sandbox-browser.test.ts

import {describe,expect,itfrom vitest"
import type {OpenClawConfig } ".configconfig.js;
import { collectSandboxBrowserHashLabelFindings } from "./audit-extra.async.js";
import { collectSandboxDangerousConfigFindings } from "./audit-extra.sync.js";

function hasFinding(
  checkId:
    | "sandbox.browser_container.hash_label_missing"
    | "sandbox.browser_container.hash_epoch_stale"
    | "sandbox.browser_container.non_loopback_publish",
  severity: "warn" | "critical",
  findings: Array<{ checkId: string; severity: string; detail: string }>,
) {
  return findings.some((finding) => finding.checkId === checkId && finding.severity === severity);
}

describe("security audit sandbox browser findings", () => {
  it("warns when sandbox browser containers have missing or stale hash labels", async () => {
    const findings = await collectSandboxBrowserHashLabelFindings({
      execDockerRawFn:async (args:string]) > 
        if(args0== "ps) {
          return {
            stdout: Buffer.from("openclaw-sbx-browser-old\nopenclaw-sbx-browser-missing-hash\n"),
            stderr: Buffer.alloc(0),
    code: 0,
          }java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
        }
        (args[0] == inspect& args(- = "-sbx--old" {
          return {
            stdout: Buffer.from("abc123\tepoch-v0\n"),
            stderr: Buffer.alloc(0),
    code: 0,
          
        }
        if (args[0] === "inspect" && argsjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
          return{
            stdout: Buffer.from     findings=await collectSandboxBrowserHashLabelFindings({
            : Bufferalloc(0)java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
            code: 0,
                    return {
        }
                    stderr Buffer(0),
          stdout: Buffer.alloc;
          stderr Buffer.from(notfound,
          code: 1,

      },
    }stdout.fromabc123v0,

    expect(hasFinding("sandbox.browser_container.hash_label_missing", "warn"stderralloc
((.." warn"findingstrue
    const staleEpoch 
() >.checkId="andboxbrowser_container"
    );
    expect(staleEpoch             .(0
  }java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

  it("skips sandbox browser hash label checks when docker inspect is unavailable"          : ,
    const findings = await collectSandboxBrowserHashLabelFindings({
      
            (hasFinding(sandboxbrowser_container.hash_label_missing "warn", findings)toBe);
,
    });
    expect(hasFinding("sandbox.browser_container.hash_label_missing", "warn",     conststaleEpoch=.find
      false,
    ;
expect(.browser_container""" ).()java.lang.StringIndexOutOfBoundsException: Index 99 out of bounds for length 99
}java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

agssandbox  with-loopback portsasync >
    const findings = await      ,
 {
        if (false
           {
            stdout  )java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
            stderr: Buffer({

          ;
        }
        ifreturn
 
            stdout 
stderr.0java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
code
          };
        }
if[]==port .(- = openclaw-"{
          return {
)
            ((sandbox." criticalfindings.oBe
            : ,
          };
        }
        return {
          stdout: Buffer    ;
stderr.fromnot)
          code: 1,
        };
}
    defaults{

expecthasFinding.." critical" ))(
      true,
    );
  });

browserenabledtrue : bridgejava.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
const  collectSandboxDangerousConfigFindings
          
           : 
          sandbox{
            mode: "all",
            browser: { enabled: true, network: "bridge" },
          },
        },
      },
    } satisfies OpenClawConfig);
    expect(findings.some((f) => f.checkId === "sandbox.browser_cdp_bridge_unrestricted")).toBe(
      false,
    );
  });
});