Skip to content

Commit 761af93

Browse files
timokoesslertimokoessler
committed
CI test fixes for Windows
1 parent c9fb4c6 commit 761af93

File tree

3 files changed

+126
-114
lines changed

3 files changed

+126
-114
lines changed

‎library/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@
122122
},
123123
"scripts": {
124124
"test": "node ../scripts/run-tap.js",
125-
"test:ci": "CI=true node ../scripts/run-tap.js",
125+
"test:ci": "node ../scripts/run-tap.js --ci",
126126
"build": "tsc -p tsconfig.build.json",
127127
"build:watch": "tsc --watch -p tsconfig.build.json",
128128
"lint": "npm run lint-eslint && npm run lint-tsc",

‎library/sinks/Postgres.test.ts‎

Lines changed: 107 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import * as t from "tap";
22
import { getContext, runWithContext, type Context } from "../agent/Context";
33
import { Postgres } from "./Postgres";
44
import { createTestAgent } from "../helpers/createTestAgent";
5+
import { isWindowsCi } from "../helpers/isWindowsCi";
56

67
const context: Context = {
78
remoteAddress: "::1",
@@ -18,123 +19,129 @@ const context: Context = {
1819
route: "/posts/:id",
1920
};
2021

21-
t.test("it inspects query method calls and blocks if needed", async (t) => {
22-
const agent = createTestAgent();
23-
agent.start([new Postgres()]);
22+
t.test(
23+
"it inspects query method calls and blocks if needed",
24+
{
25+
skip: isWindowsCi ? "Skip on Windows CI" : false,
26+
},
27+
async (t) => {
28+
const agent = createTestAgent();
29+
agent.start([new Postgres()]);
2430

25-
const { Client } = require("pg") as typeof import("pg");
26-
const client = new Client({
27-
user: "root",
28-
host: "127.0.0.1",
29-
database: "main_db",
30-
password: "password",
31-
port: 27016,
32-
});
33-
await client.connect();
31+
const { Client } = require("pg") as typeof import("pg");
32+
const client = new Client({
33+
user: "root",
34+
host: "127.0.0.1",
35+
database: "main_db",
36+
password: "password",
37+
port: 27016,
38+
});
39+
await client.connect();
3440

35-
try {
36-
await client.query(`
41+
try {
42+
await client.query(`
3743
CREATE TABLE IF NOT EXISTS cats (
3844
petname varchar(255)
3945
);
4046
`);
41-
await client.query("TRUNCATE cats");
42-
43-
t.same((await client.query("SELECT petname FROM cats;")).rows, []);
44-
t.same(
45-
(await client.query({ text: "SELECT petname FROM cats;" })).rows,
46-
[]
47-
);
48-
t.same(
49-
(
50-
await runWithContext(context, () => {
51-
return client.query("SELECT petname FROM cats;");
52-
})
53-
).rows,
54-
[]
55-
);
56-
t.same(
57-
(
58-
await runWithContext(context, () => {
59-
return client.query({ text: "SELECT petname FROM cats;" });
60-
})
61-
).rows,
62-
[]
63-
);
47+
await client.query("TRUNCATE cats");
6448

65-
const error = await t.rejects(async () => {
66-
await runWithContext(context, () => {
67-
return client.query("-- should be blocked");
68-
});
69-
});
70-
if (error instanceof Error) {
49+
t.same((await client.query("SELECT petname FROM cats;")).rows, []);
7150
t.same(
72-
error.message,
73-
"Zen has blocked an SQL injection: pg.query(...) originating from body.myTitle"
51+
(await client.query({ text: "SELECT petname FROM cats;" })).rows,
52+
[]
7453
);
75-
}
76-
77-
const error2 = await t.rejects(async () => {
78-
await runWithContext(context, () => {
79-
return client.query({ text: "-- should be blocked" });
80-
});
81-
});
82-
if (error2 instanceof Error) {
8354
t.same(
84-
error2.message,
85-
"Zen has blocked an SQL injection: pg.query(...) originating from body.myTitle"
55+
(
56+
await runWithContext(context, () => {
57+
return client.query("SELECT petname FROM cats;");
58+
})
59+
).rows,
60+
[]
8661
);
87-
}
88-
89-
const undefinedQueryError = await t.rejects(async () => {
90-
await runWithContext(context, () => {
91-
// @ts-expect-error Test
92-
return client.query(null);
93-
});
94-
});
95-
if (undefinedQueryError instanceof Error) {
9662
t.same(
97-
undefinedQueryError.message,
98-
"Client was passed a null or undefined query"
63+
(
64+
await runWithContext(context, () => {
65+
return client.query({ text: "SELECT petname FROM cats;" });
66+
})
67+
).rows,
68+
[]
9969
);
100-
}
10170

102-
await runWithContext(
103-
{
104-
remoteAddress: "::1",
105-
method: "POST",
106-
url: "http://localhost:4000/",
107-
query: {},
108-
headers: {},
109-
body: {},
110-
cookies: {},
111-
source: "express",
112-
route: "/posts/:id",
113-
routeParams: {},
114-
},
115-
() => {
116-
return client.query("-- This is a comment");
71+
const error = await t.rejects(async () => {
72+
await runWithContext(context, () => {
73+
return client.query("-- should be blocked");
74+
});
75+
});
76+
if (error instanceof Error) {
77+
t.same(
78+
error.message,
79+
"Zen has blocked an SQL injection: pg.query(...) originating from body.myTitle"
80+
);
11781
}
118-
);
11982

120-
// Check if context is available in the callback
121-
runWithContext(context, () => {
122-
client.query("SELECT petname FROM cats;", (error, result) => {
123-
t.match(getContext(), context);
83+
const error2 = await t.rejects(async () => {
84+
await runWithContext(context, () => {
85+
return client.query({ text: "-- should be blocked" });
86+
});
87+
});
88+
if (error2 instanceof Error) {
89+
t.same(
90+
error2.message,
91+
"Zen has blocked an SQL injection: pg.query(...) originating from body.myTitle"
92+
);
93+
}
12494

125-
try {
126-
client.query("-- should be blocked", () => {});
127-
} catch (error: any) {
128-
t.match(
129-
error.message,
130-
/Zen has blocked an SQL injection: pg.query\(\.\.\.\) originating from body\.myTitle/
131-
);
95+
const undefinedQueryError = await t.rejects(async () => {
96+
await runWithContext(context, () => {
97+
// @ts-expect-error Test
98+
return client.query(null);
99+
});
100+
});
101+
if (undefinedQueryError instanceof Error) {
102+
t.same(
103+
undefinedQueryError.message,
104+
"Client was passed a null or undefined query"
105+
);
106+
}
107+
108+
await runWithContext(
109+
{
110+
remoteAddress: "::1",
111+
method: "POST",
112+
url: "http://localhost:4000/",
113+
query: {},
114+
headers: {},
115+
body: {},
116+
cookies: {},
117+
source: "express",
118+
route: "/posts/:id",
119+
routeParams: {},
120+
},
121+
() => {
122+
return client.query("-- This is a comment");
132123
}
124+
);
125+
126+
// Check if context is available in the callback
127+
runWithContext(context, () => {
128+
client.query("SELECT petname FROM cats;", (error, result) => {
129+
t.match(getContext(), context);
130+
131+
try {
132+
client.query("-- should be blocked", () => {});
133+
} catch (error: any) {
134+
t.match(
135+
error.message,
136+
/Zen has blocked an SQL injection: pg.query\(\.\.\.\) originating from body\.myTitle/
137+
);
138+
}
139+
});
133140
});
134-
});
135-
} catch (error: any) {
136-
t.fail(error);
137-
} finally {
138-
await client.end();
141+
} catch (error: any) {
142+
t.fail(error);
143+
} finally {
144+
await client.end();
145+
}
139146
}
140-
});
147+
);

‎library/sinks/Shelljs.test.ts‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import { Shelljs } from "./Shelljs";
44
import { ChildProcess } from "./ChildProcess";
55
import { FileSystem } from "./FileSystem";
66
import { createTestAgent } from "../helpers/createTestAgent";
7+
import { isWindows } from "../helpers/isWindows";
78

89
const dangerousContext: Context = {
910
remoteAddress: "::1",
@@ -139,22 +140,26 @@ t.test("it detects async shell injections", async (t) => {
139140
}
140141
});
141142

142-
t.test("it prevents path injections using ls", async (t) => {
143-
const shelljs = require("shelljs");
143+
t.test(
144+
"it prevents path injections using ls",
145+
{ skip: isWindows ? "Skip on Windows" : undefined },
146+
async (t) => {
147+
const shelljs = require("shelljs");
144148

145-
const error = await t.rejects(async () => {
146-
runWithContext(dangerousPathContext, () => {
147-
return shelljs.ls("/etc/ssh");
149+
const error = await t.rejects(async () => {
150+
runWithContext(dangerousPathContext, () => {
151+
return shelljs.ls("/etc/ssh");
152+
});
148153
});
149-
});
150-
t.ok(error instanceof Error);
151-
if (error instanceof Error) {
152-
t.same(
153-
error.message,
154-
"Zen has blocked a path traversal attack: fs.readdirSync(...) originating from body.myTitle"
155-
);
154+
t.ok(error instanceof Error);
155+
if (error instanceof Error) {
156+
t.same(
157+
error.message,
158+
"Zen has blocked a path traversal attack: fs.readdirSync(...) originating from body.myTitle"
159+
);
160+
}
156161
}
157-
});
162+
);
158163

159164
t.test("it prevents path injections using cat", async (t) => {
160165
const shelljs = require("shelljs");

0 commit comments

Comments
 (0)