🧪 Testing: Insufficient Security Test Coverage / 安全测试覆盖不足

[ACCSCI]

Summary / 概述

The test suite lacks security-focused test cases, leaving vulnerabilities undetected.
测试套件缺乏以安全为重点的测试用例，导致漏洞未被发现。

Current Test Coverage / 当前测试覆盖

Existing Tests / 现有测试

• ✅ Basic API functionality (E1-E18) / 基本API功能
• ✅ Session lifecycle / 会话生命周期
• ✅ Port allocation / 端口分配
• ✅ Concurrent operations / 并发操作

Missing Tests / 缺失测试

• ❌ Command injection attempts / 命令注入尝试
• ❌ WebSocket authentication / WebSocket认证
• ❌ Input validation edge cases / 输入验证边界情况
• ❌ Malicious input handling / 恶意输入处理

Recommended Security Tests / 推荐的安全测试

1. Command Injection Tests / 命令注入测试

describe('Command Injection Prevention / 命令注入防护', () => {
  it('should reject session IDs with shell special characters / 应拒绝包含shell特殊字符的session ID', async () => {
    const maliciousIds = [
      'test"; rm -rf / #',
      'test`whoami`',
      'test$(id)',
      'test|cat /etc/passwd',
      'test&&malicious',
    ];
    
    for (const id of maliciousIds) {
      const res = await api('POST', '/api/projects/testproj/sessions', { 
        name: 'test',
        sessionId: id 
      });
      expect(res.status).toBe(400);
    }
  });
  
  it('should sanitize branch names / 应清理分支名称', async () => {
    const maliciousNames = [
      'branch"; echo pwned',
      'branch`whoami`',
      'branch$(id)',
    ];
    
    for (const name of maliciousNames) {
      const res = await api('POST', '/api/projects/testproj/sessions', { 
        name: name 
      });
      // Should either reject or sanitize / 应拒绝或清理
      expect(res.status).toBeLessThan(500);
    }
  });
});

2. WebSocket Authentication Tests / WebSocket认证测试

describe('WebSocket Security / WebSocket安全', () => {
  it('should reject connections without valid terminal ID / 应拒绝没有有效terminal ID的连接', async () => {
    const ws = new WebSocket('ws://localhost:20086/api/terminal');
    
    await expect(new Promise((resolve, reject) => {
      ws.on('close', (code) => resolve(code));
      ws.on('error', reject);
    })).resolves.toBe(1008); // Policy Violation / 策略违规
  });
  
  it('should reject connections with non-existent terminal ID / 应拒绝不存在的terminal ID的连接', async () => {
    const ws = new WebSocket('ws://localhost:20086/api/terminal?terminalId=nonexistent');
    
    await expect(new Promise((resolve, reject) => {
      ws.on('close', (code) => resolve(code));
      ws.on('error', reject);
    })).resolves.toBe(1008);
  });
});

3. Input Validation Tests / 输入验证测试

describe('Input Validation / 输入验证', () => {
  it('should reject project paths with directory traversal / 应拒绝包含目录遍历的项目路径', async () => {
    const maliciousPaths = [
      '../../../etc/passwd',
      '..\..\..\windows\system32',
      '/etc/shadow',
    ];
    
    for (const path of maliciousPaths) {
      const res = await api('POST', '/api/projects', { 
        name: 'test', 
        path: path 
      });
      expect(res.status).toBe(400);
    }
  });
  
  it('should validate port numbers / 应验证端口号', async () => {
    const invalidPorts = [-1, 0, 65536, 99999, 'abc'];
    
    for (const port of invalidPorts) {
      const res = await api('POST', '/api/init', { 
        projectPath: '/test',
        port: port 
      });
      expect(res.status).toBe(400);
    }
  });
});

Implementation Plan / 实施计划

Phase 1 / 阶段 1: Critical Security Tests / 关键安全测试

• Command injection tests / 命令注入测试
• Input validation tests / 输入验证测试
• Path traversal tests / 路径遍历测试

Phase 2 / 阶段 2: Authentication Tests / 认证测试

• WebSocket authentication tests / WebSocket认证测试
• Session validation tests / 会话验证测试
• Rate limiting tests / 速率限制测试

Phase 3 / 阶段 3: Edge Case Tests / 边界情况测试

• Malformed JSON handling / 畸形JSON处理
• Large payload handling / 大负载处理
• Unicode character handling / Unicode字符处理

Priority / 优先级

Medium / 中危 - Should be implemented alongside security fixes / 应与安全修复一起实施

Labels / 标签

• testing
• security
• medium-priority