Function TestScriptGeneratorNoUserStringInterpolation

shell/tracescript_test.go:269–308

(t *testing.T)

}

func TestScriptGeneratorNoUserStringInterpolation(t *testing.T) {
	// SECURITY TEST: Verify that user-provided values are never
	// directly interpolated as strings into the script

	// Try various concerning inputs - all should be rejected by validation
	// but even if they made it here, they should be safe

	// Create a generator with an IP that could be injection attempt
	// Note: This IP is valid but we verify it's converted to hex
	ip := net.ParseIP("127.0.0.1")
	config := TraceConfig{
		FilterIPs:  []net.IP{ip},
		OutputJSON: false,
	}

	gen := NewScriptGenerator(config)
	filter := gen.buildSkbIPFilterCondition()

	// The node name should NOT appear in the filter
	if strings.Contains(filter, "evil-node") {
		t.Error("node name should not appear in filter condition")
	}

	// The filter should only contain safe characters
	// Allow: hex digits, whitespace, operators, struct names, etc.
	// Disallow: semicolons, backticks, $() syntax
	dangerousPatterns := []string{
		"`;",
		"$()",
		"`",
		"system(",
		"exec(",
	}

	for _, pattern := range dangerousPatterns {
		if strings.Contains(filter, pattern) {
			t.Errorf("filter contains dangerous pattern: %s", pattern)
		}
	}
}

func TestBuildIPFilter(t *testing.T) {
	tests := []struct {