test_governance_gates_security.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests for governance gate scan (path safety, no shell).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from pathlib import Path |
| 6 | |
| 7 | from adapters.config import ConfigError, load_config |
| 8 | from tests.support import FIXTURES |
| 9 | |
| 10 | |
| 11 | def test_governance_gates_surfaces_reject_unknown_entries(tmp_path: Path) -> None: |
| 12 | base = (FIXTURES / "config-governance-gates.yaml").read_text(encoding="utf-8") |
| 13 | bad = base.replace( |
| 14 | " - handover-paste", |
| 15 | " - handover-paste\n - exec-malicious", |
| 16 | ) |
| 17 | path = tmp_path / "bad.yaml" |
| 18 | path.write_text(bad, encoding="utf-8") |
| 19 | try: |
| 20 | load_config(path) |
| 21 | raised = False |
| 22 | except ConfigError: |
| 23 | raised = True |
| 24 | assert raised |
| 25 | |
| 26 | |
| 27 | def test_scan_does_not_follow_path_escape_contract(tmp_path: Path) -> None: |
| 28 | from tools.governance_gates import scan_governance_gates |
| 29 | |
| 30 | config = load_config(FIXTURES / "config-governance-gates.yaml") |
| 31 | docs = tmp_path / "docs" |
| 32 | docs.mkdir(parents=True) |
| 33 | (docs / "ROADMAP.md").write_text( |
| 34 | "| **Escape** | Thinking | **WIP** | `../../../etc/passwd` |\n", |
| 35 | encoding="utf-8", |
| 36 | ) |
| 37 | (docs / "OVERSEER-HANDOVER.md").write_text("| **ID** | **Escape** |\n", encoding="utf-8") |
| 38 | result = scan_governance_gates(config, tmp_path) |
| 39 | assert all("passwd" not in (gate.artifact or "") for gate in result.pending) |