Function TestLocalSandbox_SecurityLevels

pkg/sandbox/local_test.go:343–396

(t *testing.T)

}

func TestLocalSandbox_SecurityLevels(t *testing.T) {
	tmpDir, err := os.MkdirTemp("", "sandbox-test-*")
	if err != nil {
		t.Fatalf("failed to create temp dir: %v", err)
	}
	defer func() { _ = os.RemoveAll(tmpDir) }()

	tests := []struct {
		name          string
		securityLevel SecurityLevel
		command       string
		shouldBlock   bool
	}{
		{
			name:          "basic level allows ls",
			securityLevel: SecurityLevelBasic,
			command:       "ls -la",
			shouldBlock:   false,
		},
		{
			name:          "strict level allows whitelisted command",
			securityLevel: SecurityLevelStrict,
			command:       "ls -la",
			shouldBlock:   false,
		},
		{
			name:          "strict level blocks non-whitelisted command",
			securityLevel: SecurityLevelStrict,
			command:       "nc -l 8080",
			shouldBlock:   true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			sb, err := NewLocalSandbox(&LocalSandboxConfig{
				WorkDir:       tmpDir,
				SecurityLevel: tt.securityLevel,
			})
			if err != nil {
				t.Fatalf("failed to create sandbox: %v", err)
			}

			result, err := sb.Exec(context.Background(), tt.command, nil)
			if err != nil {
				t.Fatalf("exec failed: %v", err)
			}

			if tt.shouldBlock && result.Code == 0 {
				t.Errorf("command should be blocked: %s", tt.command)
			}
		})
	}
}

func TestLocalSandbox_EnhancedDangerousPatterns(t *testing.T) {
	tmpDir, err := os.MkdirTemp("", "sandbox-test-*")