abxpkg/tests/test_security_controls.py at main · ArchiveBox/abxpkg · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
import logging
import tempfile
from pathlib import Path

import pytest

from abxpkg import (
    Binary,
    BashProvider,
    BrewProvider,
    EnvProvider,
    NpmProvider,
    PipProvider,
    SemVer,
)
from abxpkg.exceptions import BinaryInstallError, BinaryLoadError


class TestSecurityControls:
    def test_env_defaults_only_apply_to_supported_providers(self, monkeypatch):
        monkeypatch.setenv("ABXPKG_MIN_RELEASE_AGE", "13")
        monkeypatch.setenv("ABXPKG_POSTINSTALL_SCRIPTS", "true")

        assert PipProvider().min_release_age == 13
        assert PipProvider().postinstall_scripts is True
        assert NpmProvider().min_release_age == 13
        assert NpmProvider().postinstall_scripts is True
        assert EnvProvider().min_release_age is None
        assert EnvProvider().postinstall_scripts is None
        assert BashProvider().min_release_age is None
        assert BashProvider().postinstall_scripts is None

    def test_env_provider_defaults_do_not_fail_closed(self, test_machine):
        installed = EnvProvider().install("python")
        test_machine.assert_shallow_binary_loaded(installed)

    def test_unsupported_provider_security_options_warn_and_continue(
        self,
        caplog,
        test_machine,
    ):
        with caplog.at_level(logging.WARNING, logger="abxpkg.binprovider"):
            installed = EnvProvider().install(
                "python",
                postinstall_scripts=False,
                min_release_age=7,
            )

        test_machine.assert_shallow_binary_loaded(installed)
        assert "ignoring unsupported min_release_age=7" in caplog.text
        assert "ignoring unsupported postinstall_scripts=False" in caplog.text

    def test_binary_defaults_do_not_break_unsupported_provider(self):
        binary = Binary(name="python", binproviders=[EnvProvider()])
        installed = binary.install()

        assert installed.loaded_binprovider is not None
        assert installed.loaded_abspath is not None
        assert installed.loaded_version is not None

    def test_binary_load_enforces_final_min_version(self):
        binary = Binary(
            name="python",
            binproviders=[
                EnvProvider(postinstall_scripts=True, min_release_age=0),
            ],
            min_version=SemVer("999.0.0"),
            postinstall_scripts=True,
            min_release_age=0,
        )

        with pytest.raises(BinaryLoadError):
            binary.load()

    def test_pip_provider_default_security_settings_are_overridden_by_binary(
        self,
        test_machine,
    ):
        with tempfile.TemporaryDirectory() as tmpdir:
            provider = PipProvider(
                install_root=Path(tmpdir) / "venv",
                postinstall_scripts=False,
                min_release_age=36500,
            )
            binary = Binary(
                name="saws",
                binproviders=[provider],
                postinstall_scripts=True,
                min_release_age=0,
            )
            installed = binary.install()
            test_machine.assert_shallow_binary_loaded(
                installed,
                assert_version_command=False,
            )

    def test_npm_provider_default_security_settings_are_overridden_by_binary(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            provider = NpmProvider(
                install_root=Path(tmpdir) / "npm",
                postinstall_scripts=False,
                min_release_age=36500,
            ).get_provider_with_overrides(
                overrides={"optipng": {"install_args": ["optipng-bin"]}},
            )
            binary = Binary(
                name="optipng",
                binproviders=[provider],
                postinstall_scripts=True,
                min_release_age=0,
            )
            installed = binary.install()
            assert installed is not None
            assert installed.loaded_abspath is not None

    def test_pip_provider_default_security_settings_fail_closed_without_override(self):
        with pytest.raises(BinaryInstallError):
            Binary(
                name="saws",
                binproviders=[
                    PipProvider(
                        postinstall_scripts=False,
                        min_release_age=36500,
                    ),
                ],
                postinstall_scripts=False,
                min_release_age=0,
            ).install()

    def test_nullable_provider_security_fields_resolve_before_handlers_run(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            assert (
                PipProvider(
                    install_root=Path(tmpdir) / "pip",
                    dry_run=True,
                    postinstall_scripts=None,
                    min_release_age=None,
                ).install("black", no_cache=True)
                is not None
            )
            assert (
                NpmProvider(
                    install_root=Path(tmpdir) / "npm",
                    dry_run=True,
                    postinstall_scripts=None,
                    min_release_age=None,
                ).install("zx", no_cache=True)
                is not None
            )
            assert (
                BrewProvider(
                    dry_run=True,
                    postinstall_scripts=None,
                ).install("node", no_cache=True)
                is not None
            )