test_landing_security.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security tests — landing HTML must not leak secrets or load external scripts.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import re |
| 6 | from pathlib import Path |
| 7 | |
| 8 | from tools.landing.validate import SECRET_PATTERNS, validate_landing |
| 9 | |
| 10 | KIT_ROOT = Path(__file__).resolve().parents[2] |
| 11 | LANDING_DIR = KIT_ROOT / "docs" / "landing" |
| 12 | |
| 13 | |
| 14 | def test_no_external_script_tags() -> None: |
| 15 | for html_path in LANDING_DIR.rglob("*.html"): |
| 16 | text = html_path.read_text(encoding="utf-8") |
| 17 | assert not re.search(r"""<script[^>]+src\s*=\s*["']https?://""", text, re.I) |
| 18 | assert "eval(" not in text.lower() |
| 19 | theme = LANDING_DIR / "assets" / "theme.js" |
| 20 | assert theme.is_file() |
| 21 | assert "eval(" not in theme.read_text(encoding="utf-8").lower() |
| 22 | |
| 23 | |
| 24 | def test_no_secret_patterns_in_landing_html() -> None: |
| 25 | for html_path in LANDING_DIR.rglob("*.html"): |
| 26 | text = html_path.read_text(encoding="utf-8") |
| 27 | for pattern in SECRET_PATTERNS: |
| 28 | assert not pattern.search(text), f"{html_path.name} matched {pattern.pattern}" |
| 29 | |
| 30 | |
| 31 | def test_validate_rejects_injected_secret(tmp_path: Path) -> None: |
| 32 | landing = tmp_path / "docs" / "landing" |
| 33 | landing.mkdir(parents=True) |
| 34 | (landing / "manifest.yaml").write_text( |
| 35 | (KIT_ROOT / "docs" / "landing" / "manifest.yaml").read_text(encoding="utf-8") |
| 36 | ) |
| 37 | bad_html = (KIT_ROOT / "docs" / "landing" / "index.html").read_text(encoding="utf-8") |
| 38 | bad_html = bad_html.replace( |
| 39 | "</head>", |
| 40 | '<meta name="api_key" content="sk-abcdefghijklmnopqrstuvwxyz1234567890"></head>', |
| 41 | ) |
| 42 | (landing / "index.html").write_text(bad_html, encoding="utf-8") |
| 43 | scenarios = landing / "scenarios" |
| 44 | scenarios.mkdir() |
| 45 | (scenarios / "index.html").write_text( |
| 46 | (KIT_ROOT / "docs" / "landing" / "scenarios" / "index.html").read_text(encoding="utf-8") |
| 47 | ) |
| 48 | (landing / "assets").mkdir() |
| 49 | (landing / "assets" / "style.css").write_text("body{}", encoding="utf-8") |
| 50 | (tmp_path / "LICENSE").write_text( |
| 51 | "MIT License\nCopyright 2026 Overseer Kit contributors\n", |
| 52 | encoding="utf-8", |
| 53 | ) |
| 54 | (tmp_path / "SECURITY.md").write_text("Reporting a vulnerability\n", encoding="utf-8") |
| 55 | |
| 56 | result = validate_landing(tmp_path) |
| 57 | assert not result.ok |
| 58 | assert any(e.startswith("secret_leak:") for e in result.errors) |