test_checkpoints_security.py
python
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83
chore(governance): sync handover+roadmap to 84db8c8 (drift:…
Human
2 days ago
| 1 | """Security tests for checkpoint path discipline and JSON emission.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import json |
| 6 | from pathlib import Path |
| 7 | |
| 8 | import yaml |
| 9 | |
| 10 | from cli.kit_root import kit_root |
| 11 | from tests.support import git_status_runner, run_cli, seed_checkpoint_repo |
| 12 | |
| 13 | |
| 14 | def test_manifest_path_escape_refused(tmp_path: Path, capsys) -> None: |
| 15 | seed_checkpoint_repo(tmp_path) |
| 16 | code = run_cli( |
| 17 | ["verify-step", "--step", "alpha", "--manifest", "../../../etc/passwd", "--json"], |
| 18 | cwd=tmp_path, |
| 19 | runner=git_status_runner(), |
| 20 | kit=kit_root(), |
| 21 | json_mode=True, |
| 22 | ) |
| 23 | assert code == 4 |
| 24 | payload = json.loads(capsys.readouterr().out) |
| 25 | assert payload["exit_code"] == 4 |
| 26 | manifest = payload.get("manifest") or "" |
| 27 | assert not manifest.startswith("/") |
| 28 | |
| 29 | |
| 30 | def test_json_emits_on_nonzero_usage(tmp_path: Path, capsys) -> None: |
| 31 | seed_checkpoint_repo(tmp_path) |
| 32 | code = run_cli( |
| 33 | ["verify-step", "--json"], |
| 34 | cwd=tmp_path, |
| 35 | runner=git_status_runner(), |
| 36 | kit=kit_root(), |
| 37 | json_mode=True, |
| 38 | ) |
| 39 | assert code == 1 |
| 40 | payload = json.loads(capsys.readouterr().out) |
| 41 | assert payload["error"] == "usage" |
| 42 | assert payload["dry_run"] is False |
| 43 | |
| 44 | |
| 45 | def test_disabled_module_json_without_manifest(tmp_path: Path, capsys) -> None: |
| 46 | from tests.support import write_config |
| 47 | |
| 48 | write_config(tmp_path, "config-git-only.yaml") |
| 49 | code = run_cli( |
| 50 | ["verify-step", "--step", "alpha", "--json"], |
| 51 | cwd=tmp_path, |
| 52 | runner=git_status_runner(), |
| 53 | kit=kit_root(), |
| 54 | json_mode=True, |
| 55 | ) |
| 56 | assert code == 4 |
| 57 | payload = json.loads(capsys.readouterr().out) |
| 58 | assert payload["exit_code"] == 4 |
| 59 | |
| 60 | |
| 61 | def test_policy_escape_refused(tmp_path: Path) -> None: |
| 62 | seed_checkpoint_repo(tmp_path) |
| 63 | code = run_cli( |
| 64 | ["verify-step", "--step", "alpha", "--policy", "/etc/passwd"], |
| 65 | cwd=tmp_path, |
| 66 | runner=git_status_runner(), |
| 67 | kit=kit_root(), |
| 68 | ) |
| 69 | assert code == 4 |
File History
1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199
fix(ISR): default require_independent_second_reviewer to require
Human
minor
⚠
2 days ago