TestComposeScanBody_IncludesTextAttachment: exfil content hiding in a text attachment must reach the scanned blob (adversarial review #6).
(t *testing.T)
| 143 | // TestComposeScanBody_IncludesTextAttachment: exfil content hiding in a text |
| 144 | // attachment must reach the scanned blob (adversarial review #6). |
| 145 | func TestComposeScanBody_IncludesTextAttachment(t *testing.T) { |
| 146 | secret := "AKIAEXFILTRATEDSECRET payload" |
| 147 | req := outbound.SendRequest{ |
| 148 | Subject: "report", Body: "see attached", |
| 149 | Attachments: []outbound.Attachment{{ |
| 150 | Filename: "data.txt", ContentType: "text/plain", |
| 151 | Data: base64.StdEncoding.EncodeToString([]byte(secret)), |
| 152 | }}, |
| 153 | } |
| 154 | // composeScanBody now emits real MIME (base64 attachment parts); Extract decodes |
| 155 | // the attachment so the scan sees its content regardless of the declared type. |
| 156 | segs, _, err := piguard.Extract(composeScanBody(req), 0) |
| 157 | if err != nil { |
| 158 | t.Fatalf("Extract: %v", err) |
| 159 | } |
| 160 | var all string |
| 161 | for _, s := range segs { |
| 162 | all += s.Content + "\n" |
| 163 | } |
| 164 | if !strings.Contains(all, secret) { |
| 165 | t.Errorf("attachment content not extracted for scanning; segments:\n%s", all) |
| 166 | } |
| 167 | } |
| 168 | |
| 169 | // TestScreenOutbound_ScanCatchesAttachmentExfil: an injection payload smuggled in |
| 170 | // a text attachment is detected when outbound_scan=on (was evading before the fix). |
nothing calls this directly
no test coverage detected