60 lines
2.5 KiB
Bash
Executable File
60 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# commit-quality.js 單元測試
|
||
# 4 case：Bash git commit w/ staged token / Edit token / Edit getenv fallback / Edit 一般程式碼
|
||
set -u
|
||
HOOK="$(cd "$(dirname "$0")/.." && pwd)/commit-quality.js"
|
||
PASS=0; FAIL=0
|
||
|
||
# 真實格式 Telegram Token（測試字串，非活躍憑證）；分段避免完整 token 形態入庫。
|
||
TOKEN_PREFIX='8610496165:AAFOlcWV4o'
|
||
TOKEN="${TOKEN_PREFIX}RUSC2TI-fYux7JV97fjNzsYR8"
|
||
|
||
run_case() {
|
||
local name="$1"; local input="$2"; local expect="$3" # expect: allow|deny
|
||
local out
|
||
out=$(printf '%s' "$input" | node "$HOOK" 2>/dev/null)
|
||
local decision
|
||
decision=$(printf '%s' "$out" | node -e "let s='';process.stdin.on('data',c=>s+=c).on('end',()=>{try{console.log(JSON.parse(s).hookSpecificOutput.permissionDecision)}catch(e){console.log('parse-error')}})")
|
||
if [[ "$decision" == "$expect" ]]; then
|
||
echo "PASS $name -> $decision"
|
||
PASS=$((PASS+1))
|
||
else
|
||
echo "FAIL $name -> got=$decision expect=$expect"
|
||
echo " raw=$out"
|
||
FAIL=$((FAIL+1))
|
||
fi
|
||
}
|
||
|
||
# ---- case1: Bash git commit，staged 含 token ----
|
||
# 先做一個暫存 repo
|
||
TMP=$(mktemp -d)
|
||
pushd "$TMP" >/dev/null
|
||
git init -q
|
||
git config user.email t@t; git config user.name t
|
||
printf "TOKEN=%s\n" "$TOKEN" > leak.py
|
||
git add leak.py
|
||
INPUT1=$(printf '{"tool_name":"Bash","tool_input":{"command":"git commit -m x"}}')
|
||
decision=$(printf '%s' "$INPUT1" | node "$HOOK" 2>/dev/null | node -e "let s='';process.stdin.on('data',c=>s+=c).on('end',()=>{console.log(JSON.parse(s).hookSpecificOutput.permissionDecision)})")
|
||
if [[ "$decision" == "deny" ]]; then echo "PASS case1 Bash git commit staged token -> deny"; PASS=$((PASS+1)); else echo "FAIL case1 -> $decision"; FAIL=$((FAIL+1)); fi
|
||
popd >/dev/null
|
||
rm -rf "$TMP"
|
||
|
||
# ---- case2: Edit new_string 有 token ----
|
||
run_case "case2 Edit new_string token" \
|
||
"{\"tool_name\":\"Edit\",\"tool_input\":{\"file_path\":\"/x/y.py\",\"old_string\":\"a\",\"new_string\":\"TOKEN='${TOKEN}'\"}}" \
|
||
deny
|
||
|
||
# ---- case3: Edit 含 os.getenv fallback default（35 chars secret） ----
|
||
run_case "case3 Edit getenv fallback" \
|
||
"{\"tool_name\":\"Edit\",\"tool_input\":{\"file_path\":\"/x/y.py\",\"old_string\":\"a\",\"new_string\":\"TOKEN = os.getenv('TELEGRAM_BOT_TOKEN', 'AAFOlcWV4oRUSC2TI-fYux7JV97fjNzsYR8')\"}}" \
|
||
deny
|
||
|
||
# ---- case4: Edit 一般程式碼 ----
|
||
run_case "case4 Edit plain code" \
|
||
'{"tool_name":"Edit","tool_input":{"file_path":"/x/y.py","old_string":"a","new_string":"def add(x, y):\n return x + y"}}' \
|
||
allow
|
||
|
||
echo "----"
|
||
echo "PASS=$PASS FAIL=$FAIL"
|
||
[[ $FAIL -eq 0 ]]
|