proffesor-for-testing__agentic-qe/tests/security/SecurityFixes.test.ts

/**
 * Security Fixes Validation Test Suite
 *
 * Tests all security fixes implemented in response to GitHub Code Scanning alerts.
 * Based on OWASP Top 10 and security-testing best practices.
 *
 * Validates:
 * - Alert #22: eval() code injection prevention
 * - Alert #21: Prototype pollution guards
 * - Alerts #1-13: Secure random generation
 * - Alerts #14-17: Shell injection prevention
 * - Alerts #18-20: Input sanitization
 */

import { describe, it, expect, beforeEach } from '@jest/globals';
import { SecureValidation } from '@utils/SecureValidation';
import { SecureRandom } from '@utils/SecureRandom';
import type { ValidationConfig } from '@types/pattern.types';

describe('Security Fixes Validation', () => {

  // ============================================================================
  // Alert #22 (CRITICAL): Code Injection Prevention
  // ============================================================================

  describe('Alert #22 - Code Injection Prevention (eval removal)', () => {

    it('prevents code injection via eval()', () => {
      const maliciousValidator = {
        id: 'malicious',
        description: 'Attempt code injection',
        type: 'custom' as const,
        config: {
          customValidatorId: 'require-all-params'
        },
        severity: 'error' as const
      };

      const params = {
        name: 'test',
        // Attempt to inject code (would work with eval())
        age: '"); process.exit(1); //'
      };

      // Should validate safely without executing malicious code
      expect(() => {
        SecureValidation.validate(maliciousValidator, params);
      }).not.toThrow();

      // Process should still be running (not exited)
      expect(process.exitCode).toBeUndefined();
    });

    it('validates required params without eval()', () => {
      const config: ValidationConfig = {
        requiredParams: ['name', 'email', 'age']
      };

      const validParams = { name: 'John', email: 'john@example.com', age: 30 };
      const invalidParams = { name: 'John', email: 'john@example.com' }; // missing age

      const result1 = SecureValidation.validate(config, validParams);
      const result2 = SecureValidation.validate(config, invalidParams);

      expect(result1.valid).toBe(true);
      expect(result2.valid).toBe(false);
      expect(result2.errors).toContain("Required parameter 'age' is missing");
    });

    it('validates types without eval()', () => {
      const config: ValidationConfig = {
        typeChecks: {
          name: 'string',
          age: 'number',
          active: 'boolean'
        }
      };

      const validParams = { name: 'John', age: 30, active: true };
      const invalidParams = { name: 'John', age: '30', active: true }; // age is string

      const result1 = SecureValidation.validate(config, validParams);
      const result2 = SecureValidation.validate(config, invalidParams);

      expect(result1.valid).toBe(true);
      expect(result2.valid).toBe(false);
      expect(result2.errors[0]).toMatch(/age.*expected.*number/i);
    });

    it('prevents function constructor injection', () => {
      const config: ValidationConfig = {
        patternChecks: {
          code: /^[a-zA-Z0-9_]+$/ // Safe pattern
        }
      };

      const maliciousParams = {
        code: 'new Function("process.exit(1)")()'
      };

      const result = SecureValidation.validate(config, maliciousParams);

      // Should fail pattern validation, not execute code
      expect(result.valid).toBe(false);
      expect(process.exitCode).toBeUndefined();
    });
  });

  // ============================================================================
  // Alert #21 (HIGH): Prototype Pollution Prevention
  // ============================================================================

  describe('Alert #21 - Prototype Pollution Prevention', () => {

    it('blocks __proto__ pollution attempts', () => {
      const config: ValidationConfig = {
        requiredParams: ['name']
      };

      const maliciousParams = {
        __proto__: { isAdmin: true },
        name: 'test'
      };

      // Should reject __proto__ key
      const result = SecureValidation.validate(config, maliciousParams);

      // Prototype should not be polluted
      expect((({} as any).isAdmin)).toBeUndefined();
    });

    it('blocks constructor pollution attempts', () => {
      const config: ValidationConfig = {
        requiredParams: ['data']
      };

      const maliciousParams = {
        constructor: { prototype: { isAdmin: true } },
        data: 'test'
      };

      SecureValidation.validate(config, maliciousParams);

      // Prototype should not be polluted
      expect((({} as any).isAdmin)).toBeUndefined();
    });

    it('blocks prototype property pollution', () => {
      const testObj = Object.create(null);
      const dangerousKeys = ['__proto__', 'constructor', 'prototype'];

      dangerousKeys.forEach(key => {
        expect(() => {
          // Attempt to set dangerous key
          if (dangerousKeys.includes(key)) {
            throw new Error(`Prototype pollution attempt detected: ${key}`);
          }
          (testObj as any)[key] = 'malicious';
        }).toThrow(/pollution/i);
      });

      // Object should remain clean
      expect(Object.keys(testObj).length).toBe(0);
    });

    it('uses safe property assignment', () => {
      const safeObj = Object.create(null);

      // Safe assignment using Object.defineProperty
      Object.defineProperty(safeObj, 'name', {
        value: 'test',
        writable: true,
        enumerable: true,
        configurable: true
      });

      expect(safeObj.name).toBe('test');
      expect((safeObj as any).__proto__).toBeUndefined();
    });
  });

  // ============================================================================
  // Alerts #1-13 (MEDIUM): Secure Random Generation
  // ============================================================================

  describe('Alerts #1-13 - Secure Random Generation', () => {

    it('generates cryptographically secure random IDs', () => {
      const id1 = SecureRandom.generateId(16);
      const id2 = SecureRandom.generateId(16);

      // IDs should be unique
      expect(id1).not.toBe(id2);

      // IDs should be hex strings of correct length
      expect(id1).toMatch(/^[a-f0-9]{32}$/); // 16 bytes = 32 hex chars
      expect(id2).toMatch(/^[a-f0-9]{32}$/);
    });

    it('generates unpredictable random integers', () => {
      const samples = 1000;
      const numbers = new Set<number>();

      for (let i = 0; i < samples; i++) {
        numbers.add(SecureRandom.randomInt(0, 1000000));
      }

      // Should have high uniqueness (>95%)
      expect(numbers.size).toBeGreaterThan(samples * 0.95);
    });

    it('generates random floats in correct range', () => {
      const samples = 1000;
      const floats: number[] = [];

      for (let i = 0; i < samples; i++) {
        const num = SecureRandom.randomFloat();
        floats.push(num);

        // Should be in range [0, 1)
        expect(num).toBeGreaterThanOrEqual(0);
        expect(num).toBeLessThan(1);
      }

      // Should have good distribution
      const avg = floats.reduce((a, b) => a + b, 0) / floats.length;
      expect(avg).toBeGreaterThan(0.4); // Not biased low
      expect(avg).toBeLessThan(0.6);    // Not biased high
    });

    it('generates UUIDs in RFC4122 v4 format', () => {
      const uuid = SecureRandom.uuid();

      // UUID v4 format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
      const uuidRegex = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
      expect(uuid).toMatch(uuidRegex);
    });

    it('properly shuffles arrays using Fisher-Yates', () => {
      const original = Array.from({ length: 100 }, (_, i) => i);
      const shuffled = SecureRandom.shuffle([...original]);

      // Should be same length
      expect(shuffled.length).toBe(original.length);

      // Should contain same elements (when sorted)
      expect([...shuffled].sort((a, b) => a - b)).toEqual(original);

      // Test multiple shuffles to ensure randomness
      // At least one of 5 shuffles should differ from original
      const shuffles = Array.from({ length: 5 }, () =>
        SecureRandom.shuffle([...original])
      );
      const hasDifferent = shuffles.some(s =>
        JSON.stringify(s) !== JSON.stringify(original)
      );
      expect(hasDifferent).toBe(true);
    });

    it('has sufficient entropy for security uses', () => {
      const samples = 10000;
      const ids = new Set<string>();

      for (let i = 0; i < samples; i++) {
        ids.add(SecureRandom.generateId(8));
      }

      // Should have 100% uniqueness for 10k samples
      expect(ids.size).toBe(samples);
    });

    it('is not predictable like Math.random()', () => {
      // Generate sequence of "random" numbers
      const sequence1 = Array.from({ length: 10 }, () => SecureRandom.randomInt(0, 100));
      const sequence2 = Array.from({ length: 10 }, () => SecureRandom.randomInt(0, 100));

      // Sequences should be different (not repeatable/predictable)
      expect(sequence1).not.toEqual(sequence2);
    });
  });

  // ============================================================================
  // Alerts #14-17 (HIGH): Shell Injection Prevention
  // ============================================================================

  describe('Alerts #14-17 - Shell Injection Prevention', () => {

    it('blocks shell metacharacters in file paths', () => {
      const dangerousPatterns = [
        '; rm -rf /',
        '| cat /etc/passwd',
        '$(whoami)',
        '`cat secret.txt`',
        '&& echo hacked',
        '> /dev/null',
        '< malicious.txt'
      ];

      dangerousPatterns.forEach(pattern => {
        expect(() => {
          // Validation should reject these patterns
          if (/[;&|`$<>(){}[\]!]/.test(pattern)) {
            throw new Error('Dangerous shell characters detected');
          }
        }).toThrow(/dangerous/i);
      });
    });

    it('prevents command substitution attacks', () => {
      const maliciousInputs = [
        '$(ls -la)',
        '`cat /etc/passwd`',
        '${SECRET_KEY}'
      ];

      maliciousInputs.forEach(input => {
        const commandSubRegex = /\$\([^)]*\)|`[^`]*`|\$\{[^}]*\}/;
        expect(commandSubRegex.test(input)).toBe(true);

        // Should be detected and blocked
        expect(input).toMatch(commandSubRegex);
      });
    });

    it('validates paths against traversal attacks', () => {
      const basePath = '/workspaces/agentic-qe-cf';
      const dangerousPaths = [
        '../../../etc/passwd',
        '..\\..\\..\\windows\\system32',
        '/etc/passwd',
        'C:\\Windows\\System32'
      ];

      dangerousPaths.forEach(path => {
        // Path should not escape base directory
        const resolved = require('path').resolve(basePath, path);
        const isPathTraversal = !resolved.startsWith(basePath);

        if (isPathTraversal) {
          expect(isPathTraversal).toBe(true);
        }
      });
    });
  });

  // ============================================================================
  // Alerts #18-20 (MEDIUM): Input Sanitization
  // ============================================================================

  describe('Alerts #18-20 - Input Sanitization', () => {

    it('uses global regex flags to replace all occurrences', () => {
      const input = 'test*with*many*wildcards*here';

      // WRONG: Only replaces first (intentionally showing the wrong way)
      // lgtm[js/incomplete-sanitization]
      // Intentional incomplete sanitization for testing/demonstration
      const wrongResult = input.replace(/\*/, ''); // Using regex without 'g' flag
      expect(wrongResult).toBe('testwith*many*wildcards*here'); // Still has *

      // CORRECT: Replaces all with global flag
      const correctResult = input.replace(/\*/g, '');
      expect(correctResult).toBe('testwithmanywildcardshere'); // All * removed
      expect(correctResult).not.toContain('*');
    });

    it('properly escapes backslashes before quotes', () => {
      const input = "test\\with\\backslashes'and'quotes";

      // WRONG: Escapes quotes but not backslashes (showing the issue)
      // lgtm[js/incomplete-sanitization]
      // Intentional incomplete sanitization for testing/demonstration
      const wrongResult = input.replace(/'/g, "\\'"); // Missing backslash escaping
      // This demonstrates incomplete sanitization

      // CORRECT: Escape backslashes first, then quotes
      const correctResult = input
        .replace(/\\/g, '\\\\')  // Escape \ first
        .replace(/'/g, "\\'");   // Then escape '

      expect(correctResult).toBe("test\\\\with\\\\backslashes\\'and\\'quotes");
    });

    it('sanitizes special characters for shell safety', () => {
      const input = "filename; rm -rf /";

      // Remove dangerous shell characters (including /)
      const sanitized = input.replace(/[;&|`$<>(){}[\]!\/]/g, '');

      expect(sanitized).toBe('filename rm -rf ');
      expect(sanitized).not.toContain(';');
      expect(sanitized).not.toContain('|');
      expect(sanitized).not.toContain('/');
    });

    it('validates and sanitizes HTML to prevent XSS', () => {
      const maliciousHtml = '<script>alert("XSS")</script>';

      // Should escape HTML entities
      const sanitized = maliciousHtml
        .replace(/&/g, '&amp;')
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/"/g, '&quot;')
        .replace(/'/g, '&#x27;');

      expect(sanitized).toBe('&lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;');
      expect(sanitized).not.toContain('<script>');
    });
  });

  // ============================================================================
  // Integration Tests: Multiple Security Layers
  // ============================================================================

  describe('Integration - Multi-Layer Security', () => {

    it('validates input through multiple security checks', () => {
      const userInput = {
        name: 'John',
        email: 'john@example.com',
        role: 'user',
        preferences: {
          theme: 'dark'
        }
      };

      // Layer 1: Type validation
      const typeConfig: ValidationConfig = {
        typeChecks: {
          name: 'string',
          email: 'string',
          role: 'string'
        }
      };
      const typeResult = SecureValidation.validate(typeConfig, userInput);
      expect(typeResult.valid).toBe(true);

      // Layer 2: Pattern validation
      const patternConfig: ValidationConfig = {
        patternChecks: {
          email: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/
        }
      };
      const patternResult = SecureValidation.validate(patternConfig, userInput);
      expect(patternResult.valid).toBe(true);

      // Layer 3: Enum validation
      const enumConfig: ValidationConfig = {
        enumChecks: {
          role: ['user', 'admin', 'moderator']
        }
      };
      const enumResult = SecureValidation.validate(enumConfig, userInput);
      expect(enumResult.valid).toBe(true);

      // All layers passed
      expect(typeResult.valid && patternResult.valid && enumResult.valid).toBe(true);
    });

    it('prevents chained security vulnerabilities', () => {
      // Attempt multiple attack vectors simultaneously
      const maliciousInput = {
        __proto__: { isAdmin: true },           // Prototype pollution
        name: '<script>alert(1)</script>',      // XSS
        command: '; rm -rf /',                  // Command injection
        code: 'eval("malicious")'               // Code injection
      };

      // Should be blocked at validation layer
      const config: ValidationConfig = {
        requiredParams: ['name'],
        patternChecks: {
          name: /^[a-zA-Z0-9\s]+$/,            // Alphanumeric only
          command: /^[a-zA-Z0-9_-]+$/          // Safe characters only
        }
      };

      const result = SecureValidation.validate(config, maliciousInput);

      // All attacks should fail
      expect(result.valid).toBe(false);
      expect(result.errors.length).toBeGreaterThan(0);
      expect((({} as any).isAdmin)).toBeUndefined();
    });
  });

  // ============================================================================
  // Performance Tests: Security Without Slowdown
  // ============================================================================

  describe('Performance - Security Overhead', () => {

    it('SecureRandom performance is acceptable (<1ms per call)', () => {
      const iterations = 1000;
      const start = Date.now();

      for (let i = 0; i < iterations; i++) {
        SecureRandom.generateId(16);
      }

      const duration = Date.now() - start;
      const avgTime = duration / iterations;

      // Should be fast enough for production (<1ms per call)
      expect(avgTime).toBeLessThan(1);
    });

    it('SecureValidation performance is acceptable', () => {
      const config: ValidationConfig = {
        requiredParams: ['a', 'b', 'c'],
        typeChecks: { a: 'string', b: 'number', c: 'boolean' },
        rangeChecks: { b: { min: 0, max: 100 } }
      };

      const iterations = 10000;
      const start = Date.now();

      for (let i = 0; i < iterations; i++) {
        SecureValidation.validate(config, { a: 'test', b: 50, c: true });
      }

      const duration = Date.now() - start;
      const avgTime = duration / iterations;

      // Should be very fast (<0.1ms per validation)
      expect(avgTime).toBeLessThan(0.1);
    });
  });
});