bonsai-ninja-security 0.2.2

Security rulepack loader, matcher, and source/sink/sanitizer wrapper for bonsai-ninja.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

use super::{call_candidate_matches_package_tail, import_matches_package};
use crate::loader::{PackageMatchSemantics, PackageTailBindingSemantics};

fn dotted() -> PackageMatchSemantics {
    PackageMatchSemantics {
        package_separators: vec![".".to_string()],
        ..Default::default()
    }
}

#[test]
fn exact_match_needs_no_language_policy() {
    assert!(import_matches_package(
        "dependency",
        "dependency",
        &PackageMatchSemantics::default()
    ));
}

#[test]
fn prefix_and_suffix_normalization_are_metadata_driven() {
    let semantics = PackageMatchSemantics {
        strip_import_prefixes: vec!["runtime:".to_string()],
        strip_import_suffixes: vec![".header".to_string()],
        package_separators: vec!["/".to_string()],
        ..Default::default()
    };
    assert!(import_matches_package("runtime:io/async", "io", &semantics));
    assert!(import_matches_package("storage.header", "storage", &semantics));
    assert!(!import_matches_package("runtime_tools", "tools", &semantics));
}

#[test]
fn namespace_separators_are_metadata_driven_and_boundary_safe() {
    let semantics = PackageMatchSemantics {
        package_separators: vec![".".to_string(), "::".to_string(), "\\".to_string()],
        ..Default::default()
    };
    assert!(import_matches_package(
        "org.example.Type",
        "org.example",
        &semantics
    ));
    assert!(import_matches_package("DB::Handle", "DB", &semantics));
    assert!(import_matches_package("Framework\\Data", "Framework", &semantics));
    assert!(!import_matches_package("async_driver", "async", &semantics));
}

#[test]
fn package_tail_binding_is_metadata_driven() {
    let semantics = PackageMatchSemantics {
        package_separators: vec!["/".to_string()],
        call_qualifier_from_package_tail: Some(PackageTailBindingSemantics {
            package_separator: "/".to_string(),
            call_separators: vec![".".to_string()],
        }),
        ..Default::default()
    };
    assert!(call_candidate_matches_package_tail(
        "runner.Execute",
        "runtime/runner",
        &semantics
    ));
    assert!(!call_candidate_matches_package_tail(
        "runtime.Execute",
        "runtime/runner",
        &semantics
    ));
    assert!(!call_candidate_matches_package_tail(
        "runner.Execute",
        "runtime/runner",
        &dotted()
    ));
}

#[test]
fn empty_package_never_matches() {
    assert!(!import_matches_package(
        "anything",
        "",
        &PackageMatchSemantics::default()
    ));
}