py/ai-job-search
1
0
Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-09-17 08:36:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden guard JSON shape handling (#128)

Browse Source
This commit is contained in:
Ayobami Adegoke
2026-07-11 22:04:54 +02:00
committed by GitHub
parent 543d1a733e
commit 569b1df371
2 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_security_guards.py
+26
View File
@@ -92,6 +92,20 @@ class PermissionGuardTests(GuardRepoFixture):
self.assertEqual(result.returncode, 1)
self.assertIn("invalid JSON", result.stdout)
def test_malformed_settings_shape_fails_cleanly(self):
for data, message in [
([], "top-level JSON value must be an object"),
({"permissions": []}, "permissions must be an object"),
({"permissions": {"allow": "Bash(*)"}}, "permissions.allow must be a list of strings"),
({"permissions": {"allow": [1]}}, "permissions.allow must be a list of strings"),
]:
with self.subTest(data=data):
self.settings.write_text(json.dumps(data))
result = run_guards(self.root)
self.assertEqual(result.returncode, 1)
self.assertIn(message, result.stdout)
self.assertNotIn("Traceback", result.stderr)
class GitignoreGuardTests(GuardRepoFixture):
def test_each_missing_personal_data_rule_fails(self):
@@ -134,6 +148,18 @@ class ManifestGuardTests(GuardRepoFixture):
self.assertEqual(result.returncode, 1)
self.assertIn("trustedDependencies", result.stdout)
def test_malformed_manifest_shape_fails_cleanly(self):
for data, message in [
([], "top-level JSON value must be an object"),
({"name": "example-cli", "scripts": []}, "scripts must be an object"),
]:
with self.subTest(data=data):
self.write_manifest(data)
result = run_guards(self.root)
self.assertEqual(result.returncode, 1)
self.assertIn(message, result.stdout)
self.assertNotIn("Traceback", result.stderr)
def test_benign_scripts_pass(self):
self.write_manifest(
{"name": "example-cli", "scripts": {"start": "bun run src/cli.ts", "test": "bun test", "typecheck": "tsc --noEmit"}}