66 lines
2.1 KiB
TypeScript
66 lines
2.1 KiB
TypeScript
import { spawnSync } from "node:child_process";
|
|
import { readFile } from "node:fs/promises";
|
|
|
|
type Document = Record<string, unknown>;
|
|
|
|
function record(value: unknown, label: string): Document {
|
|
if (!value || typeof value !== "object" || Array.isArray(value)) {
|
|
throw new TypeError(`${label} must be an object`);
|
|
}
|
|
return value as Document;
|
|
}
|
|
|
|
const artifact = "artifacts/security/scan-fixture.sarif";
|
|
const scan = spawnSync(
|
|
"node",
|
|
[
|
|
"scripts/security-scan.ts",
|
|
"--policy",
|
|
"tests/fixtures/security/secret-detection/forbidden-policy.json",
|
|
"--artifact",
|
|
artifact,
|
|
],
|
|
{ encoding: "utf8" },
|
|
);
|
|
if (scan.error || scan.signal || scan.status !== 1) {
|
|
throw new Error(
|
|
`forbidden security fixture did not fail exactly: ${scan.error?.message ?? scan.stderr}`,
|
|
);
|
|
}
|
|
|
|
const sarif = record(
|
|
JSON.parse(await readFile(artifact, "utf8")),
|
|
"security fixture SARIF",
|
|
);
|
|
const runs = Array.isArray(sarif.runs) ? sarif.runs : [];
|
|
const run = record(runs[0], "security fixture SARIF run");
|
|
const results = Array.isArray(run.results) ? run.results : [];
|
|
const actual = results
|
|
.map((rawResult) => {
|
|
const result = record(rawResult, "security fixture result");
|
|
const locations = Array.isArray(result.locations) ? result.locations : [];
|
|
const location = record(locations[0], "security fixture location");
|
|
const physical = record(
|
|
location.physicalLocation,
|
|
"security fixture physical location",
|
|
);
|
|
const artifactLocation = record(
|
|
physical.artifactLocation,
|
|
"security fixture artifact location",
|
|
);
|
|
return `${String(artifactLocation.uri)}:${String(result.ruleId)}`;
|
|
})
|
|
.sort();
|
|
const root = "tests/fixtures/security/secret-detection/forbidden";
|
|
const expected = [
|
|
`${root}/config.json:assigned-secret`,
|
|
`${root}/dist.ts:assigned-secret`,
|
|
`${root}/source.ts:aws-access-key`,
|
|
].sort();
|
|
if (JSON.stringify(actual) !== JSON.stringify(expected)) {
|
|
throw new Error(
|
|
`security fixture findings mismatch: expected ${expected.join(", ")}; received ${actual.join(", ")}`,
|
|
);
|
|
}
|
|
process.stdout.write("Security fixtures: 3 forbidden files detected\n");
|