56 lines
2.7 KiB
Python
56 lines
2.7 KiB
Python
import json
|
|
from pathlib import Path
|
|
import tempfile
|
|
import unittest
|
|
from server_buddy.core.validation import validate_hostname
|
|
from server_buddy.collectors.demo import collect_demo, DEMO_HOST
|
|
from server_buddy.analyzers.assessment import assess
|
|
from server_buddy.reporting.export import export_html, export_json
|
|
|
|
class CoreTests(unittest.TestCase):
|
|
def test_hostname(self):
|
|
self.assertEqual(validate_hostname(' DEMO-WEB-01.example.test. '), DEMO_HOST)
|
|
for value in ['', '-host', 'a..b', 'https://host', 'host;whoami', 'host$(id)', 'a'*64]:
|
|
with self.subTest(value=value), self.assertRaises(ValueError):
|
|
validate_hostname(value)
|
|
|
|
def test_demo_rejects_real_hosts(self):
|
|
with self.assertRaises(ValueError):
|
|
collect_demo('production.example.test')
|
|
data = collect_demo(DEMO_HOST)
|
|
data['server']['hostname'] = 'changed'
|
|
self.assertEqual(collect_demo(DEMO_HOST)['server']['hostname'], DEMO_HOST)
|
|
|
|
def test_evidence_and_missing_activity(self):
|
|
data = collect_demo(DEMO_HOST)
|
|
result = assess(data)
|
|
self.assertTrue(all(f['evidence'] for f in result['findings']))
|
|
self.assertTrue(any(f['classification'] == 'Confirmed observed activity' for f in result['findings']))
|
|
data['inventory']['network'] = []
|
|
self.assertTrue(any('does not prove' in f['evidence'] for f in assess(data)['findings']))
|
|
self.assertTrue(any('ad:' in f['evidence'] for f in result['findings']))
|
|
|
|
def test_export_and_escape(self):
|
|
data = collect_demo(DEMO_HOST)
|
|
data['server']['hostname'] = '<script>alert(1)</script>'
|
|
with tempfile.TemporaryDirectory() as directory:
|
|
report = Path(directory) / 'report.html'
|
|
export_html(report, data, assess(data))
|
|
text = report.read_text()
|
|
self.assertNotIn('<script>', text)
|
|
self.assertIn('SYNTHETIC', text)
|
|
self.assertIn('missing evidence', text)
|
|
self.assertIn('manual verification', text)
|
|
output = Path(directory) / 'report.json'
|
|
export_json(output, data, assess(data))
|
|
self.assertTrue(json.loads(output.read_text())['inventory_result']['synthetic'])
|
|
|
|
def test_schema(self):
|
|
try:
|
|
import jsonschema
|
|
except ImportError:
|
|
self.skipTest('jsonschema not installed')
|
|
schema = json.loads(Path('schemas/inventory-v1.schema.json').read_text())
|
|
for data in [collect_demo(DEMO_HOST), json.loads(Path('tests/fixtures/synthetic_inventory.json').read_text())]:
|
|
jsonschema.Draft202012Validator(schema, format_checker=jsonschema.FormatChecker()).validate(data)
|