Function test_command_validation

test_security.py:336–379

Test project command validation.

()

def test_command_validation():
    """Test project command validation."""
    print("\nTesting command validation:\n")
    passed = 0
    failed = 0

    # Test cases: (cmd_config, should_be_valid, description)
    test_cases = [
        # Valid commands
        ({"name": "swift", "description": "Swift compiler"}, True, "valid command"),
        ({"name": "swift"}, True, "command without description"),
        ({"name": "swift*", "description": "All Swift tools"}, True, "pattern command"),
        ({"name": "./scripts/build.sh", "description": "Build script"}, True, "local script"),

        # Invalid commands
        ({}, False, "missing name"),
        ({"description": "No name"}, False, "missing name field"),
        ({"name": ""}, False, "empty name"),
        ({"name": 123}, False, "non-string name"),

        # Security: Bare wildcard not allowed
        ({"name": "*"}, False, "bare wildcard rejected"),

        # Blocklisted commands
        ({"name": "sudo"}, False, "blocklisted sudo"),
        ({"name": "shutdown"}, False, "blocklisted shutdown"),
        ({"name": "dd"}, False, "blocklisted dd"),
    ]

    for cmd_config, should_be_valid, description in test_cases:
        valid, error = validate_project_command(cmd_config)
        if valid == should_be_valid:
            print(f"  PASS: {description}")
            passed += 1
        else:
            expected = "valid" if should_be_valid else "invalid"
            actual = "valid" if valid else "invalid"
            print(f"  FAIL: {description}")
            print(f"         Expected: {expected}, Got: {actual}")
            if error:
                print(f"         Error: {error}")
            failed += 1

    return passed, failed


def test_blocklist_enforcement():