vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-06 06:00:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: merge shell payload plan checks

Browse Source
This commit is contained in:
Peter Steinberger
2026-04-17 20:01:58 +01:00
parent f897025d9b
commit e9d052d728
1 changed files with 25 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
src/node-host/invoke-system-run-plan.test.ts
View File

@@ -921,36 +921,31 @@ describe("hardenApprovedExecutionPaths", () => {
}
});
it("keeps fail-closed behavior for shell payloads that invoke mutable script files", () => {
expectShellPayloadApprovalDenied({
tmpPrefix: "openclaw-shell-script-binding-",
fileName: "run.sh",
body: "#!/bin/sh\necho SAFE\n",
});
});
it("keeps fail-closed behavior for empty shell payload files", () => {
expectShellPayloadApprovalDenied({
tmpPrefix: "openclaw-shell-empty-binding-",
fileName: "empty",
body: "",
});
});
it("does not treat weak MZ text headers as native binaries", () => {
expectShellPayloadApprovalDenied({
tmpPrefix: "openclaw-shell-mz-text-binding-",
fileName: "mz-script",
body: "MZ not really a PE file\n",
});
});
it("keeps fail-closed behavior for unknown NUL-bearing headers", () => {
expectShellPayloadApprovalDenied({
tmpPrefix: "openclaw-shell-nul-header-binding-",
fileName: "nul-script",
body: "SAFE\u0000maybe-binary\n",
});
it("keeps fail-closed behavior for mutable or ambiguous shell payload files", () => {
for (const testCase of [
{
tmpPrefix: "openclaw-shell-script-binding-",
fileName: "run.sh",
body: "#!/bin/sh\necho SAFE\n",
},
{
tmpPrefix: "openclaw-shell-empty-binding-",
fileName: "empty",
body: "",
},
{
tmpPrefix: "openclaw-shell-mz-text-binding-",
fileName: "mz-script",
body: "MZ not really a PE file\n",
},
{
tmpPrefix: "openclaw-shell-nul-header-binding-",
fileName: "nul-script",
body: "SAFE\u0000maybe-binary\n",
},
]) {
expectShellPayloadApprovalDenied(testCase);
}
});
it("keeps fail-closed behavior when the shell payload probe stops seeing a file", () => {