Logan.LiandCursor
2fd1624bec
收紧 SSH 命令护栏、权限校验与远程执行会话，并同步主流大模型供应商列表。 Co-authored-by: Cursor <cursoragent@cursor.com>
51 lines
1.6 KiB
Go
51 lines
1.6 KiB
Go
package guardrail
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestSanitizeTextMasksCommonSecrets(t *testing.T) {
|
|
input := "Authorization: Bearer abcdefghijklmnopqrstuvwxyz password=secret123 mysql://root:pass@db/prod AKIA1234567890ABCDEF"
|
|
got := SanitizeText(input)
|
|
for _, leak := range []string{"abcdefghijklmnopqrstuvwxyz", "secret123", "root:pass@db", "AKIA1234567890ABCDEF"} {
|
|
if strings.Contains(got, leak) {
|
|
t.Fatalf("敏感信息未脱敏: %s in %s", leak, got)
|
|
}
|
|
}
|
|
if !strings.Contains(got, "[REDACTED]") {
|
|
t.Fatalf("脱敏标记缺失: %s", got)
|
|
}
|
|
}
|
|
|
|
func TestSanitizeJSONMasksSensitiveKeys(t *testing.T) {
|
|
got := SanitizeJSON(`{"command":"echo ok","password":"p1","nested":{"api_key":"k1"}}`)
|
|
for _, leak := range []string{"p1", "k1"} {
|
|
if strings.Contains(got, leak) {
|
|
t.Fatalf("JSON 敏感字段未脱敏: %s in %s", leak, got)
|
|
}
|
|
}
|
|
if !strings.Contains(got, `"command":"echo ok"`) {
|
|
t.Fatalf("非敏感字段不应被改写: %s", got)
|
|
}
|
|
}
|
|
|
|
func TestSanitizeMapReturnsMaskedCopy(t *testing.T) {
|
|
input := map[string]interface{}{
|
|
"command": "curl -H 'Authorization: Bearer abcdefghijklmnop' https://example.test",
|
|
"nested": map[string]interface{}{"password": "plain-secret"},
|
|
}
|
|
|
|
got := SanitizeMap(input)
|
|
if got["command"] == input["command"] {
|
|
t.Fatal("命令中的令牌未脱敏")
|
|
}
|
|
nested := got["nested"].(map[string]interface{})
|
|
if nested["password"] != "[REDACTED]" {
|
|
t.Fatalf("密码字段未脱敏: %#v", nested["password"])
|
|
}
|
|
if input["nested"].(map[string]interface{})["password"] != "plain-secret" {
|
|
t.Fatal("脱敏不得修改原始参数")
|
|
}
|
|
}
|