aaronrene / overseer-kit public
test_landing_security.py python
52 lines 2.1 KB
Raw
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 55 days ago
1 """Security tests — landing HTML must not leak secrets or load external scripts."""
2
3 from __future__ import annotations
4
5 import re
6 from pathlib import Path
7
8 from tools.landing.validate import SECRET_PATTERNS, validate_landing
9
10 KIT_ROOT = Path(__file__).resolve().parents[2]
11 LANDING_DIR = KIT_ROOT / "docs" / "landing"
12
13
14 def test_no_external_script_tags() -> None:
15 for html_path in LANDING_DIR.rglob("*.html"):
16 text = html_path.read_text(encoding="utf-8")
17 assert not re.search(r"""<script[^>]+src\s*=\s*["']https?://""", text, re.I)
18 assert "eval(" not in text.lower()
19
20
21 def test_no_secret_patterns_in_landing_html() -> None:
22 for html_path in LANDING_DIR.rglob("*.html"):
23 text = html_path.read_text(encoding="utf-8")
24 for pattern in SECRET_PATTERNS:
25 assert not pattern.search(text), f"{html_path.name} matched {pattern.pattern}"
26
27
28 def test_validate_rejects_injected_secret(tmp_path: Path) -> None:
29 landing = tmp_path / "docs" / "landing"
30 landing.mkdir(parents=True)
31 (landing / "manifest.yaml").write_text(
32 (KIT_ROOT / "docs" / "landing" / "manifest.yaml").read_text(encoding="utf-8")
33 )
34 bad_html = (KIT_ROOT / "docs" / "landing" / "index.html").read_text(encoding="utf-8")
35 bad_html = bad_html.replace(
36 "</head>",
37 '<meta name="api_key" content="sk-abcdefghijklmnopqrstuvwxyz1234567890"></head>',
38 )
39 (landing / "index.html").write_text(bad_html, encoding="utf-8")
40 scenarios = landing / "scenarios"
41 scenarios.mkdir()
42 (scenarios / "index.html").write_text(
43 (KIT_ROOT / "docs" / "landing" / "scenarios" / "index.html").read_text(encoding="utf-8")
44 )
45 (landing / "assets").mkdir()
46 (landing / "assets" / "style.css").write_text("body{}", encoding="utf-8")
47 (tmp_path / "LICENSE").write_text("Apache License Version 2.0\nApache-2.0", encoding="utf-8")
48 (tmp_path / "SECURITY.md").write_text("Reporting a vulnerability\n", encoding="utf-8")
49
50 result = validate_landing(tmp_path)
51 assert not result.ok
52 assert any(e.startswith("secret_leak:") for e in result.errors)
File History 1 commit
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 55 days ago