mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
e233c02314
Comments, doc comments, UI labels, log and error messages, LLM prompt strings, markdown docs, test data and assertions. Identifiers, enum keys, routes, placeholders and code structure are unchanged. Notes: - docs/漏洞流量证据.md renamed to docs/vulnerability-traffic-evidence.md - tests that exercised CJK specific handling (GBK zip names, Chinese full text search) now use ASCII equivalents; go build passes and the test suite matches the pre translation baseline (remaining failures need a PostgreSQL DSN and fail identically on the original) - frontend mention syntax now uses English kinds (finding, asset, ...) matching the backend, chat mentions tests pass
49 lines
1.8 KiB
Go
49 lines
1.8 KiB
Go
package db
|
|
|
|
import (
|
|
"regexp"
|
|
"testing"
|
|
)
|
|
|
|
// The built-in "delete-like endpoint path" rule matches the entire tool_input JSON
|
|
// string, so the cases are given directly in JSON form, consistent with the subject
|
|
// the Interceptor actually receives.
|
|
func TestDeleteEndpointPathPattern(t *testing.T) {
|
|
re := regexp.MustCompile(deleteEndpointPathPattern)
|
|
|
|
hit := []string{
|
|
`{"command":"curl -s 'http://t.com/api/user/delete?id=1'"}`, // GET hitting a delete endpoint
|
|
`{"command":"curl -X POST http://t.com/admin/delete -d id=1"}`, // POST hitting a delete endpoint
|
|
`{"command":"curl 'http://t.com/api/deleteAll'"}`,
|
|
`{"command":"curl 'http://t.com/api/delete_user?id=1'"}`,
|
|
`{"command":"curl 'http://t.com/api/delete-user?id=1'"}`,
|
|
`{"url":"http://t.com/api/remove?id=1"}`,
|
|
`{"command":"curl http://t.com/files/unlink/3"}`,
|
|
`{"command":"curl http://t.com/api/del?id=2"}`,
|
|
`{"command":"curl -X POST http://t/v1/erase"}`,
|
|
`{"command":"curl http://t/admin/destroyAll"}`, // v1's path rule forbids a suffix; covered here
|
|
}
|
|
for _, s := range hit {
|
|
if !re.MatchString(s) {
|
|
t.Errorf("should have hit but was allowed: %s", s)
|
|
}
|
|
}
|
|
|
|
// The verb must be followed by a separator, so read-only paths like /delivery and
|
|
// /details are not falsely intercepted.
|
|
miss := []string{
|
|
`{"command":"curl 'http://t.com/api/delivery?id=1'"}`,
|
|
`{"command":"curl 'http://t.com/order/details'"}`,
|
|
`{"command":"curl 'http://t.com/api/delta/sync'"}`,
|
|
`{"command":"curl 'http://t.com/user/delegate'"}`,
|
|
`{"command":"curl 'http://delete.example.com/'"}`, // the delete verb appears in the domain, not the path
|
|
`{"command":"curl 'http://t.com/remote/status'"}`,
|
|
`{"command":"nmap -p80 10.0.0.1"}`,
|
|
}
|
|
for _, s := range miss {
|
|
if re.MatchString(s) {
|
|
t.Errorf("false interception: %s", s)
|
|
}
|
|
}
|
|
}
|