|
| 1 | +use scanner_core::*; |
| 2 | +use std::fs; |
| 3 | +use std::path::{Path, PathBuf}; |
| 4 | +use std::sync::Arc; |
| 5 | +use std::time::{SystemTime, UNIX_EPOCH}; |
| 6 | + |
| 7 | +fn write_file(dir: &Path, rel: &str, contents: &str) { |
| 8 | + let path = dir.join(rel); |
| 9 | + if let Some(parent) = path.parent() { |
| 10 | + fs::create_dir_all(parent).unwrap(); |
| 11 | + } |
| 12 | + fs::write(path, contents).unwrap(); |
| 13 | +} |
| 14 | + |
| 15 | +fn tmp_dir(prefix: &str) -> PathBuf { |
| 16 | + let mut base = std::env::temp_dir(); |
| 17 | + let ts = SystemTime::now() |
| 18 | + .duration_since(UNIX_EPOCH) |
| 19 | + .unwrap() |
| 20 | + .as_nanos(); |
| 21 | + let pid = std::process::id(); |
| 22 | + base.push(format!("cipherscope_test_{}_{}_{}", prefix, pid, ts)); |
| 23 | + fs::create_dir_all(&base).unwrap(); |
| 24 | + base |
| 25 | +} |
| 26 | + |
| 27 | +fn load_registry() -> Arc<PatternRegistry> { |
| 28 | + let workspace = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../.."); |
| 29 | + let patterns_path = workspace.join("patterns.toml"); |
| 30 | + let patterns = fs::read_to_string(patterns_path).unwrap(); |
| 31 | + Arc::new(PatternRegistry::load(&patterns).unwrap()) |
| 32 | +} |
| 33 | + |
| 34 | +#[test] |
| 35 | +fn commented_import_does_not_trigger_anchor_java() { |
| 36 | + let reg = load_registry(); |
| 37 | + let dets: Vec<Box<dyn Detector>> = vec![Box::new(PatternDetector::new( |
| 38 | + "detector-java", |
| 39 | + &[Language::Java], |
| 40 | + reg.clone(), |
| 41 | + ))]; |
| 42 | + let cfg = Config::default(); |
| 43 | + let scanner = Scanner::new(®, dets, cfg); |
| 44 | + |
| 45 | + let dir = tmp_dir("commented_import_java"); |
| 46 | + write_file( |
| 47 | + &dir, |
| 48 | + "src/Main.java", |
| 49 | + r#"package test; |
| 50 | +// import javax.crypto.Cipher; // commented anchor |
| 51 | +public class Main { |
| 52 | + public static void main(String[] args) throws Exception { |
| 53 | + javax.crypto.Cipher.getInstance("AES/GCM/NoPadding"); // API present |
| 54 | + } |
| 55 | +} |
| 56 | +"#, |
| 57 | + ); |
| 58 | + let findings = scanner.run(std::slice::from_ref(&dir)).unwrap(); |
| 59 | + assert!( |
| 60 | + !findings.iter().any(|f| f.library == "Java JCA/JCE"), |
| 61 | + "JCA/JCE should not be reported when import is commented" |
| 62 | + ); |
| 63 | +} |
| 64 | + |
| 65 | +#[test] |
| 66 | +fn php_api_only_reports_openssl() { |
| 67 | + let reg = load_registry(); |
| 68 | + let dets: Vec<Box<dyn Detector>> = vec![Box::new(PatternDetector::new( |
| 69 | + "detector-php", |
| 70 | + &[Language::Php], |
| 71 | + reg.clone(), |
| 72 | + ))]; |
| 73 | + let cfg = Config::default(); |
| 74 | + let scanner = Scanner::new(®, dets, cfg); |
| 75 | + |
| 76 | + let dir = tmp_dir("php_openssl_api_only"); |
| 77 | + write_file( |
| 78 | + &dir, |
| 79 | + "web/index.php", |
| 80 | + r#"<?php |
| 81 | +// No imports for PHP OpenSSL detector; API use is enough |
| 82 | +$ciphertext = openssl_encrypt("data", "aes-256-cbc", "key", 0, "1234567890123456"); |
| 83 | +echo $ciphertext; |
| 84 | +"#, |
| 85 | + ); |
| 86 | + let findings = scanner.run(std::slice::from_ref(&dir)).unwrap(); |
| 87 | + assert!( |
| 88 | + findings.iter().any(|f| f.library == "OpenSSL (PHP)"), |
| 89 | + "OpenSSL (PHP) should be reported on API use only" |
| 90 | + ); |
| 91 | +} |
| 92 | + |
| 93 | +#[test] |
| 94 | +fn include_glob_filters_file_types() { |
| 95 | + let reg = load_registry(); |
| 96 | + let dets_java: Vec<Box<dyn Detector>> = vec![ |
| 97 | + Box::new(PatternDetector::new( |
| 98 | + "detector-java", |
| 99 | + &[Language::Java], |
| 100 | + reg.clone(), |
| 101 | + )), |
| 102 | + Box::new(PatternDetector::new( |
| 103 | + "detector-php", |
| 104 | + &[Language::Php], |
| 105 | + reg.clone(), |
| 106 | + )), |
| 107 | + ]; |
| 108 | + |
| 109 | + let dir = tmp_dir("include_glob_filters"); |
| 110 | + // Java file with anchor+API |
| 111 | + write_file( |
| 112 | + &dir, |
| 113 | + "src/Main.java", |
| 114 | + r#"package test; |
| 115 | +import java.security.MessageDigest; |
| 116 | +public class Main { |
| 117 | + public static void main(String[] args) throws Exception { |
| 118 | + java.security.KeyFactory.getInstance("RSA"); |
| 119 | + } |
| 120 | +} |
| 121 | +"#, |
| 122 | + ); |
| 123 | + // PHP file with API |
| 124 | + write_file( |
| 125 | + &dir, |
| 126 | + "web/index.php", |
| 127 | + r#"<?php |
| 128 | +echo openssl_encrypt("data", "aes-256-cbc", "key", 0, "1234567890123456"); |
| 129 | +"#, |
| 130 | + ); |
| 131 | + |
| 132 | + // Only Java |
| 133 | + let cfg_java_only = Config { |
| 134 | + include_globs: vec!["**/*.java".to_string()], |
| 135 | + ..Default::default() |
| 136 | + }; |
| 137 | + let scanner_java = Scanner::new(®, dets_java, cfg_java_only); |
| 138 | + let findings_java = scanner_java.run(std::slice::from_ref(&dir)).unwrap(); |
| 139 | + assert!(findings_java.iter().any(|f| f.library == "Java JCA/JCE")); |
| 140 | + assert!( |
| 141 | + !findings_java.iter().any(|f| f.library == "OpenSSL (PHP)"), |
| 142 | + "PHP findings should be excluded by include_glob" |
| 143 | + ); |
| 144 | + |
| 145 | + // Only PHP |
| 146 | + let cfg_php_only = Config { |
| 147 | + include_globs: vec!["**/*.php".to_string()], |
| 148 | + ..Default::default() |
| 149 | + }; |
| 150 | + let dets_php: Vec<Box<dyn Detector>> = vec![ |
| 151 | + Box::new(PatternDetector::new( |
| 152 | + "detector-java", |
| 153 | + &[Language::Java], |
| 154 | + reg.clone(), |
| 155 | + )), |
| 156 | + Box::new(PatternDetector::new( |
| 157 | + "detector-php", |
| 158 | + &[Language::Php], |
| 159 | + reg.clone(), |
| 160 | + )), |
| 161 | + ]; |
| 162 | + let scanner_php = Scanner::new(®, dets_php, cfg_php_only); |
| 163 | + let findings_php = scanner_php.run(std::slice::from_ref(&dir)).unwrap(); |
| 164 | + assert!(findings_php.iter().any(|f| f.library == "OpenSSL (PHP)")); |
| 165 | + assert!( |
| 166 | + !findings_php.iter().any(|f| f.library == "Java JCA/JCE"), |
| 167 | + "Java findings should be excluded by include_glob" |
| 168 | + ); |
| 169 | +} |
| 170 | + |
| 171 | +#[test] |
| 172 | +fn max_file_size_skips_large_files() { |
| 173 | + let reg = load_registry(); |
| 174 | + let dets: Vec<Box<dyn Detector>> = vec![Box::new(PatternDetector::new( |
| 175 | + "detector-java", |
| 176 | + &[Language::Java], |
| 177 | + reg.clone(), |
| 178 | + ))]; |
| 179 | + |
| 180 | + let dir = tmp_dir("max_file_size"); |
| 181 | + // Create a large Java file that would otherwise match JCA |
| 182 | + let mut content = String::from( |
| 183 | + "package test;\nimport javax.crypto.Cipher;\npublic class Big { public static void main(String[] a){ } }\n", |
| 184 | + ); |
| 185 | + // Append enough data to exceed threshold |
| 186 | + for _ in 0..5000 { |
| 187 | + content.push_str("// padding padding padding padding padding padding\n"); |
| 188 | + } |
| 189 | + write_file(&dir, "src/Big.java", &content); |
| 190 | + |
| 191 | + let cfg_small_limit = Config { |
| 192 | + max_file_size: 512, // bytes |
| 193 | + ..Default::default() |
| 194 | + }; |
| 195 | + let scanner = Scanner::new(®, dets, cfg_small_limit); |
| 196 | + let findings = scanner.run(std::slice::from_ref(&dir)).unwrap(); |
| 197 | + assert!( |
| 198 | + findings.is_empty(), |
| 199 | + "Large file should be skipped by max_file_size" |
| 200 | + ); |
| 201 | +} |
0 commit comments