test_check_ok_security.py
python
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
3 days ago
| 1 | """Security — Check-if-OK refuses path escape; no secrets in scaffold.""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from datetime import date |
| 6 | from pathlib import Path |
| 7 | |
| 8 | import pytest |
| 9 | |
| 10 | from cli.kit_root import kit_root |
| 11 | from tests.support import git_status_runner, run_cli, write_config |
| 12 | from tools.check_ok.scaffold import render_side_check_markdown, scaffold_side_check |
| 13 | |
| 14 | |
| 15 | def test_scaffold_rejects_escape(tmp_path: Path) -> None: |
| 16 | with pytest.raises(ValueError, match="path-escape"): |
| 17 | scaffold_side_check(tmp_path, path="../../etc/passwd") |
| 18 | |
| 19 | |
| 20 | def test_cli_rejects_escape(tmp_path: Path) -> None: |
| 21 | write_config(tmp_path, "config-git-only.yaml") |
| 22 | code = run_cli( |
| 23 | ["check-ok", "--path", "../../etc/passwd", "--scaffold-only"], |
| 24 | cwd=tmp_path, |
| 25 | runner=git_status_runner(), |
| 26 | kit=kit_root(), |
| 27 | ) |
| 28 | assert code == 4 |
| 29 | |
| 30 | |
| 31 | def test_scaffold_body_has_no_secret_placeholders() -> None: |
| 32 | body = render_side_check_markdown( |
| 33 | topic="sec", |
| 34 | phase_id="check-ok-sec", |
| 35 | scope="security tier", |
| 36 | output_path="docs/reviews/x.md", |
| 37 | date_stamp="2026-07-17", |
| 38 | ) |
| 39 | lowered = body.lower() |
| 40 | assert "api_key" not in lowered |
| 41 | assert "private_key" not in lowered |
| 42 | assert "password" not in lowered |
File History
1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
3 days ago