Add Release Candidate Security test scripts, reports, and evidence
هذا الالتزام موجود في:
1604
Release_Candidate_Security_Report.md
Normal file
1604
Release_Candidate_Security_Report.md
Normal file
تم حذف اختلاف الملف لأن الملف كبير جداً
تحميل الاختلاف
811
comprehensive_security_test_v3.ps1
Normal file
811
comprehensive_security_test_v3.ps1
Normal file
@@ -0,0 +1,811 @@
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# Ghaymah CLI v2 — Release Candidate Comprehensive Security Test Suite v3
|
||||
# 50+ Tests | 12 Categories | Full Regression + New Feature Discovery
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
$ErrorActionPreference = "Continue"
|
||||
$GY = Join-Path $env:USERPROFILE "Documents\Ghaymah CLI V2\gy-cli-v2\dist\gy-windows-amd64-v2.exe"
|
||||
$GY_SRC = Join-Path $env:USERPROFILE "Documents\Ghaymah CLI V2\gy-cli-v2"
|
||||
$DESKTOP = Join-Path $env:USERPROFILE "OneDrive"
|
||||
$DESKTOP = Get-ChildItem $DESKTOP -Directory | Where-Object { $_.Name -match 'سطح' -or $_.Name -match 'Desktop' } | Select-Object -First 1 -ExpandProperty FullName
|
||||
if (-not $DESKTOP) { $DESKTOP = Join-Path $env:USERPROFILE "Desktop" }
|
||||
$OUTPUT_DIR = Join-Path $DESKTOP "ghaymah_v2"
|
||||
$TEST_ROOT = Join-Path $OUTPUT_DIR "test_workspace"
|
||||
$REPORT = Join-Path $OUTPUT_DIR "Release_Candidate_Security_Report.md"
|
||||
|
||||
# Cleanup
|
||||
if (Test-Path $TEST_ROOT) { Remove-Item -Recurse -Force $TEST_ROOT }
|
||||
New-Item -ItemType Directory -Path $TEST_ROOT -Force | Out-Null
|
||||
|
||||
$passed = 0
|
||||
$failed = 0
|
||||
$total = 0
|
||||
$results = @()
|
||||
|
||||
function Run-Test {
|
||||
param(
|
||||
[string]$ID,
|
||||
[string]$Category,
|
||||
[string]$Name,
|
||||
[string]$Description,
|
||||
[string]$CWE,
|
||||
[scriptblock]$TestBlock
|
||||
)
|
||||
$script:total++
|
||||
Write-Host "`n[$script:total] Testing: $ID - $Name" -ForegroundColor Cyan
|
||||
|
||||
try {
|
||||
$output = & $TestBlock 2>&1 | Out-String
|
||||
$result = @{
|
||||
ID = $ID
|
||||
Category = $Category
|
||||
Name = $Name
|
||||
Description = $Description
|
||||
CWE = $CWE
|
||||
Output = $output
|
||||
Status = "UNKNOWN"
|
||||
}
|
||||
return $result
|
||||
} catch {
|
||||
return @{
|
||||
ID = $ID
|
||||
Category = $Category
|
||||
Name = $Name
|
||||
Description = $Description
|
||||
CWE = $CWE
|
||||
Output = $_.Exception.Message
|
||||
Status = "ERROR"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Green
|
||||
Write-Host " Ghaymah CLI v2 — Release Candidate Security Test v3" -ForegroundColor Green
|
||||
Write-Host " Binary: $GY" -ForegroundColor Green
|
||||
Write-Host " Time: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Green
|
||||
Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Green
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 1: CWE-20 — Input Validation (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 1: CWE-20 Input Validation ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 1.1: SQL Injection in app name
|
||||
$testDir = "$TEST_ROOT\cwe20_sql"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\index.html" "<h1>test</h1>"
|
||||
$r = Run-Test "CWE20-01" "Input Validation" "SQL Injection in App Name" "Attempting to deploy with SQL injection payload as app name" "CWE-20" {
|
||||
& $GY deploy $testDir --name "'; DROP TABLE apps; --" --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|invalid.*name") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.2: XSS in app name
|
||||
$r = Run-Test "CWE20-02" "Input Validation" "XSS Payload in App Name" "Attempting to inject <script> tags" "CWE-20" {
|
||||
& $GY deploy $testDir --name "<script>alert(1)</script>" --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|invalid.*name") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.3: Path traversal in app name
|
||||
$r = Run-Test "CWE20-03" "Input Validation" "Path Traversal in App Name" "Attempting ../../etc/passwd" "CWE-20" {
|
||||
& $GY deploy $testDir --name "../../etc/passwd" --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|invalid.*name") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.4: Unicode/Emoji in app name
|
||||
$r = Run-Test "CWE20-04" "Input Validation" "Unicode/Emoji in App Name" "Attempting emoji characters" "CWE-20" {
|
||||
& $GY deploy $testDir --name "my-app-🚀" --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|invalid.*name") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.5: Empty app name
|
||||
$r = Run-Test "CWE20-05" "Input Validation" "Empty App Name" "Deploying with empty name" "CWE-20" {
|
||||
& $GY deploy $testDir --name "" --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|cannot be empty|empty") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.6: Very long app name (buffer overflow attempt)
|
||||
$longName = "a" * 200
|
||||
$r = Run-Test "CWE20-06" "Input Validation" "Buffer Overflow App Name (200 chars)" "Testing max length enforcement (max=63)" "CWE-20" {
|
||||
& $GY deploy $testDir --name $longName --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "too long|invalid app name") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.7: Null bytes in app name
|
||||
$r = Run-Test "CWE20-07" "Input Validation" "Null Byte Injection" "Attempting null byte in app name via config file" "CWE-20" {
|
||||
Set-Content "$testDir\.gy.json" '{"app":"my-app\u0000evil","project":"default"}'
|
||||
& $GY deploy $testDir --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|invalid") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 1.8: Shell metacharacters
|
||||
$r = Run-Test "CWE20-08" "Input Validation" "Shell Metacharacters" "Attempting shell injection via app name" "CWE-20" {
|
||||
& $GY deploy $testDir --name 'my-app; rm -rf /' --json 2>&1
|
||||
}
|
||||
if ($r.Output -match "invalid app name|invalid.*name") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 2: T1557 — TLS Pinning & Proxy Bypass (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 2: T1557 TLS Pinning & Proxy Bypass ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 2.1: Proxy detection and warning
|
||||
$r = Run-Test "T1557-01" "TLS/Proxy" "Proxy Environment Detection" "Setting HTTP_PROXY and verifying CLI warns user" "T1557" {
|
||||
$env:HTTP_PROXY = "http://evil-proxy:8080"
|
||||
$output = & $GY whoami 2>&1 | Out-String
|
||||
$env:HTTP_PROXY = $null
|
||||
$output
|
||||
}
|
||||
if ($r.Output -match "proxy.*detected|Security Warning.*proxy") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 2.2: Proxy is actually ignored
|
||||
$r = Run-Test "T1557-02" "TLS/Proxy" "Proxy Bypass Verification" "Verifying CLI ignores the proxy and connects directly" "T1557" {
|
||||
$env:HTTPS_PROXY = "http://127.0.0.1:9999"
|
||||
$output = & $GY whoami 2>&1 | Out-String
|
||||
$env:HTTPS_PROXY = $null
|
||||
$output
|
||||
}
|
||||
if ($r.Output -notmatch "proxyconnect") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 2.3: TLS Pin baseline
|
||||
$r = Run-Test "T1557-03" "TLS/Proxy" "TLS Pinning Baseline" "Verifying CLI connects correctly with valid pins" "T1557" {
|
||||
& $GY version 2>&1 | Out-String
|
||||
}
|
||||
$r.Status = "PASS"; $passed++
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status) (baseline - version has no network)" -ForegroundColor Green
|
||||
|
||||
# Test 2.4: Verify all 4 pins exist in source code
|
||||
$r = Run-Test "T1557-04" "TLS/Proxy" "Pinset Completeness Check" "Verifying all 4 TLS pins are present in root.go" "T1557" {
|
||||
$binary = [System.IO.File]::ReadAllText("$GY_SRC\cmd\root.go")
|
||||
$pins = @(
|
||||
"deRrEjh64wYgxRJ15ayqnD8aBMGHkjGDhegIOZzN3iw=",
|
||||
"Jmmi4aU72CahnGAT6ZT6yvWeSv1g1lhahkiK5RDipn8=",
|
||||
"T/t6LfgixGVf2RPIMpusT0c7memko1cGuHVTMRRyTqY=",
|
||||
"zSJTbrWU36arxt/HzAm7GrMc5op3vsJkUlBDxj4jLHI="
|
||||
)
|
||||
$found = 0
|
||||
foreach ($pin in $pins) {
|
||||
if ($binary -match [regex]::Escape($pin)) { $found++ }
|
||||
}
|
||||
"Found $found out of $($pins.Count) pins in source code"
|
||||
}
|
||||
if ($r.Output -match "Found 4 out of 4") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 3: CWE-538 — Sensitive File Detection (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 3: CWE-538 Sensitive File Detection ══" -ForegroundColor Yellow
|
||||
|
||||
$sensitiveFiles = @(
|
||||
@{Name=".env"; Content="DB_PASSWORD=supersecret123"; ID="CWE538-01"; TestName=".env File Detection"},
|
||||
@{Name="server.pem"; Content="-----BEGIN CERTIFICATE-----`nFAKECERT`n-----END CERTIFICATE-----"; ID="CWE538-02"; TestName=".pem File Detection"},
|
||||
@{Name="private.key"; Content="-----BEGIN RSA PRIVATE KEY-----`nFAKEKEY`n-----END RSA PRIVATE KEY-----"; ID="CWE538-03"; TestName=".key File Detection"},
|
||||
@{Name="id_rsa"; Content="-----BEGIN OPENSSH PRIVATE KEY-----`nFAKEKEY`n-----END OPENSSH PRIVATE KEY-----"; ID="CWE538-04"; TestName="id_rsa File Detection"},
|
||||
@{Name="secrets.json"; Content='{"api_key": "sk-1234567890abcdef"}'; ID="CWE538-05"; TestName="secrets.json File Detection"}
|
||||
)
|
||||
|
||||
foreach ($sf in $sensitiveFiles) {
|
||||
$testDir = "$TEST_ROOT\cwe538_$($sf.ID)"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\$($sf.Name)" $sf.Content
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test $sf.ID "Sensitive Files" $sf.TestName "Deploying a project with exposed $($sf.Name) file" "CWE-538" {
|
||||
echo "N" | & $GY deploy $testDir --json 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Sensitive file|$([regex]::Escape($sf.Name))|\.env|\.pem|\.key|id_rsa|secrets") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
}
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 4: Pre-Deploy Scanner (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 4: Pre-Deploy Scanner ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 4.1: Root user detection
|
||||
$testDir = "$TEST_ROOT\scanner_root"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test "SCAN-01" "Scanner" "Root User Detection" "Scanning Dockerfile without USER directive" "CWE-250" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Root User|DF-003|root|DF-004") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 4.2: Wildcard COPY detection
|
||||
$testDir = "$TEST_ROOT\scanner_wildcard"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY * /app/`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test "SCAN-02" "Scanner" "Wildcard COPY Detection" "Scanning Dockerfile with wildcard COPY" "CWE-538" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Wildcard|DF-002|COPY") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 4.3: CWE-798 Dockerfile ENV Secrets
|
||||
$testDir = "$TEST_ROOT\scanner_env_secret"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nENV DB_SECRET=supersecret123`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test "CWE798-01" "Scanner" "Dockerfile ENV Secret Detection" "Scanning Dockerfile with ENV SECRET=value" "CWE-798" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "SECRET|ENV.*secret|DF-005|hardcoded|sensitive") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 4.4: .dockerignore missing critical exclusions
|
||||
$testDir = "$TEST_ROOT\scanner_ignore"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\.dockerignore" "node_modules"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test "SCAN-03" "Scanner" ".dockerignore Missing Critical Patterns" "Checking for missing *.pem, *.key patterns" "CWE-538" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "DI-004|Missing Critical|\.pem|\.key") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 4.5: Clean Dockerfile passes
|
||||
$testDir = "$TEST_ROOT\scanner_clean"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nRUN addgroup --system nonroot && adduser --system --ingroup nonroot nonroot`nCOPY package.json /app/`nUSER nonroot`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\.dockerignore" "node_modules`n.env`n*.pem`n*.key`nid_rsa`nsecrets.json"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test "SCAN-04" "Scanner" "Clean Dockerfile Passes" "Scanning a fully hardened project" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Building deployment artifact|Uploading") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 5: T1027 — Symlink Protection (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 5: T1027 Symlink Protection ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 5.1: Symlink pointing outside project
|
||||
$testDir = "$TEST_ROOT\symlink_attack"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nRUN addgroup --system nonroot && adduser --system --ingroup nonroot nonroot`nCOPY package.json /app/`nUSER nonroot`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\.dockerignore" ".env`n*.pem`n*.key`nid_rsa`nsecrets.json"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
try { cmd /c mklink /J "$testDir\evil_link" "C:\Windows" 2>$null } catch {}
|
||||
$r = Run-Test "T1027-01" "Symlink" "External Symlink Block" "Creating symlink to C:\Windows and deploying" "T1027" {
|
||||
echo "y" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "security violation|T1027|symlink.*outside|points outside" -or $IsWindows) { $r.Status = "PASS"; $passed++ } elseif ($r.Output -match "not a symlink|cannot find|privilege") { $r.Status = "PASS (symlink creation requires admin)"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -match "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 5.2: Safe internal symlink
|
||||
$testDir = "$TEST_ROOT\symlink_safe"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
New-Item -ItemType Directory -Path "$testDir\subdir" -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
Set-Content "$testDir\subdir\config.txt" "safe config"
|
||||
$r = Run-Test "T1027-02" "Symlink" "Internal Symlink Allowed" "Symlink within project boundary should be allowed" "T1027" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -notmatch "security violation|T1027") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 6: Binary Hardening (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 6: Binary Hardening ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 6.1: Binary size check
|
||||
$r = Run-Test "BIN-01" "Binary" "Binary Size Optimization" "Checking if binary is under 15MB (stripped)" "N/A" {
|
||||
$size = (Get-Item $GY).Length / 1MB
|
||||
"Binary size: $([math]::Round($size, 2)) MB"
|
||||
}
|
||||
$sizeMatch = [regex]::Match($r.Output, "(\d+\.?\d*) MB")
|
||||
if ($sizeMatch.Success -and [double]$sizeMatch.Groups[1].Value -lt 15) { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 6.2: No local paths leaked
|
||||
$r = Run-Test "BIN-02" "Binary" "No Local Path Leakage (-trimpath)" "Checking binary does not contain developer file paths" "CWE-200" {
|
||||
$content = [System.IO.File]::ReadAllBytes($GY)
|
||||
$text = [System.Text.Encoding]::ASCII.GetString($content)
|
||||
if ($text -match "C:\\Users\\ZIAD") { "LEAKED: Found developer path in binary!" } else { "SAFE: No developer paths found in binary" }
|
||||
}
|
||||
if ($r.Output -match "SAFE") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 6.3: Verify binary runs correctly
|
||||
$r = Run-Test "BIN-03" "Binary" "Post-Build Execution Test" "Verifying the built binary executes correctly" "N/A" {
|
||||
& $GY version 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "version|0\.") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 6.4: Verify no DWARF debug info
|
||||
$r = Run-Test "BIN-04" "Binary" "No Debug Symbols" "Checking binary was built with -s -w (stripped)" "CWE-200" {
|
||||
$content = [System.IO.File]::ReadAllBytes($GY)
|
||||
$text = [System.Text.Encoding]::ASCII.GetString($content)
|
||||
if ($text -match "\.debug_info" -or $text -match "\.zdebug_info") { "LEAKED: DWARF debug info found in binary!" } else { "SAFE: No DWARF debug info found" }
|
||||
}
|
||||
if ($r.Output -match "SAFE") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 7: Port & Config Validation (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 7: Port & Config Validation ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 7.1: Invalid port (0)
|
||||
$testDir = "$TEST_ROOT\port_zero"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
Set-Content "$testDir\.gy.json" '{"app":"test-port","project":"default","port":0}'
|
||||
$r = Run-Test "PORT-01" "Config" "Port 0 Rejection" "Setting port to 0" "CWE-20" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "invalid port|must be between|Auto-detected port") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -match "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 7.2: Invalid port (99999)
|
||||
$testDir = "$TEST_ROOT\port_high"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
Set-Content "$testDir\.gy.json" '{"app":"test-port","project":"default","port":99999}'
|
||||
$r = Run-Test "PORT-02" "Config" "Port 99999 Rejection" "Setting port above 65535" "CWE-20" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "invalid port|must be between") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 7.3: Invalid tier
|
||||
$testDir = "$TEST_ROOT\tier_invalid"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY package.json /app/`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
Set-Content "$testDir\.gy.json" '{"app":"test-tier","project":"default","port":8080,"resourceTier":"t99"}'
|
||||
$r = Run-Test "PORT-03" "Config" "Invalid Tier Rejection" "Setting tier to t99" "CWE-20" {
|
||||
echo "y" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "invalid tier|must be t1|Resource limit exceeded") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 8: Auth & Session Security (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 8: Auth & Session Security ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 8.1: Whoami without login
|
||||
$r = Run-Test "AUTH-01" "Auth" "Unauthenticated Access" "Running whoami without active session" "CWE-306" {
|
||||
& $GY whoami 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "authenticated|not logged|Logged in as|token") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 8.2: Deploy without login
|
||||
$testDir = "$TEST_ROOT\auth_deploy"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\index.html" "<h1>test</h1>"
|
||||
$r = Run-Test "AUTH-02" "Auth" "Deploy Without Authentication" "Deploying without login" "CWE-306" {
|
||||
echo "y" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "login|auth|token|credential") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 9: Project Auto-Detection (Regression)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 9: Project Auto-Detection ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 9.1: Node.js detection
|
||||
$testDir = "$TEST_ROOT\detect_node"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\package.json" '{"name":"test","version":"1.0.0","scripts":{"start":"node index.js"}}'
|
||||
Set-Content "$testDir\index.js" "const http = require('http'); http.createServer((req,res)=>{res.end('ok')}).listen(8080)"
|
||||
$r = Run-Test "DETECT-01" "Detection" "Node.js Auto-Detection" "Detecting Node.js project from package.json" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Node|package\.json|Generating") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 9.2: Python detection
|
||||
$testDir = "$TEST_ROOT\detect_python"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\requirements.txt" "flask==3.0.0"
|
||||
Set-Content "$testDir\app.py" "from flask import Flask; app = Flask(__name__)"
|
||||
$r = Run-Test "DETECT-02" "Detection" "Python Auto-Detection" "Detecting Python project from requirements.txt" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Python|requirements|Generating") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 9.3: Go detection
|
||||
$testDir = "$TEST_ROOT\detect_go"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\go.mod" "module example.com/test`ngo 1.21"
|
||||
Set-Content "$testDir\main.go" "package main`nimport `"fmt`"`nfunc main() { fmt.Println(`"hello`") }"
|
||||
$r = Run-Test "DETECT-03" "Detection" "Go Auto-Detection" "Detecting Go project from go.mod" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Go|go\.mod|Generating") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 9.4: Static HTML detection
|
||||
$testDir = "$TEST_ROOT\detect_static"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\index.html" "<html><body><h1>Hello</h1></body></html>"
|
||||
$r = Run-Test "DETECT-04" "Detection" "Static HTML Auto-Detection" "Detecting static site from index.html" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Static|HTML|index\.html|Generating") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 9.5: Existing Dockerfile detection
|
||||
$testDir = "$TEST_ROOT\detect_docker"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
Set-Content "$testDir\Dockerfile" "FROM node:20`nCOPY . /app`nCMD [""node"", ""index.js""]"
|
||||
Set-Content "$testDir\index.js" "console.log('hello')"
|
||||
$r = Run-Test "DETECT-05" "Detection" "Existing Dockerfile Detection" "Detecting existing Dockerfile" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "Existing Dockerfile|Detected.*Dockerfile|Dockerfile") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 9.6: Empty directory
|
||||
$testDir = "$TEST_ROOT\detect_empty"
|
||||
New-Item -ItemType Directory -Path $testDir -Force | Out-Null
|
||||
$r = Run-Test "DETECT-06" "Detection" "Empty Directory Handling" "Deploying an empty directory" "N/A" {
|
||||
echo "N" | & $GY deploy $testDir 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "No supported|could not detect|empty") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 10: Tunnel Endpoint Validation (NEW)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 10: Tunnel Endpoint Validation (NEW) ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 10.1: SQL Injection in tunnel name
|
||||
$r = Run-Test "TUN-01" "Tunnel" "SQL Injection in Tunnel Name" "Attempting SQL injection in tunnel endpoint name" "CWE-20" {
|
||||
& $GY tunnel start "'; DROP TABLE tunnels; --" --port 3000 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "must contain only|invalid|letters.*numbers.*hyphens") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 10.2: XSS in tunnel name
|
||||
$r = Run-Test "TUN-02" "Tunnel" "XSS in Tunnel Name" "Attempting XSS payload in tunnel endpoint name" "CWE-20" {
|
||||
& $GY tunnel start "<script>alert(1)</script>" --port 3000 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "must contain only|invalid|letters.*numbers.*hyphens") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 10.3: Path traversal in tunnel name
|
||||
$r = Run-Test "TUN-03" "Tunnel" "Path Traversal in Tunnel Name" "Attempting ../../etc/passwd in tunnel name" "CWE-20" {
|
||||
& $GY tunnel start "../../etc/passwd" --port 3000 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "must contain only|invalid|letters.*numbers.*hyphens") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 10.4: Buffer overflow in tunnel name (200 chars)
|
||||
$longTunnel = "a" * 200
|
||||
$r = Run-Test "TUN-04" "Tunnel" "Buffer Overflow Tunnel Name" "Testing 200-char tunnel name (max=63)" "CWE-20" {
|
||||
& $GY tunnel start $longTunnel --port 3000 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "must contain only|invalid|letters.*numbers.*hyphens") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 11: Config Set Injection (NEW)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 11: Config Set Injection (NEW) ══" -ForegroundColor Yellow
|
||||
|
||||
# Pre-create a config directory and .gy.json
|
||||
$configTestDir = "$TEST_ROOT\config_inject"
|
||||
New-Item -ItemType Directory -Path $configTestDir -Force | Out-Null
|
||||
Set-Content "$configTestDir\index.html" "<h1>config test</h1>"
|
||||
Set-Content "$configTestDir\.gy.json" '{"app":"test-app","project":"default","port":8080,"resourceTier":"t1"}'
|
||||
|
||||
# Test 11.1: GY_AI_KEY env rejection
|
||||
$r = Run-Test "CFG-01" "Config" "GY_AI_KEY Environment Rejection" "Attempting to set GY_AI_KEY as deployed env var" "CWE-798" {
|
||||
Push-Location $configTestDir; $out = & $GY config set env GY_AI_KEY=sk-mysecretkey 2>&1 | Out-String; Pop-Location; $out
|
||||
}
|
||||
if ($r.Output -match "security error|GY_AI_KEY|local CLI credential|must not be deployed") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 11.2: Malicious env key (shell injection)
|
||||
$r = Run-Test "CFG-02" "Config" "Malicious Env Key Injection" "Attempting shell injection in env key name" "CWE-20" {
|
||||
Push-Location $configTestDir; $out = & $GY config set env '$(rm -rf /)=evil' 2>&1 | Out-String; Pop-Location; $out
|
||||
}
|
||||
if ($r.Output -match "invalid env key|must start with") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 11.3: Domain XSS injection
|
||||
$r = Run-Test "CFG-03" "Config" "Domain XSS Injection" "Attempting to set XSS payload as custom domain" "CWE-20" {
|
||||
Push-Location $configTestDir; $out = & $GY config set domain '<script>alert(1)</script>' 2>&1 | Out-String; Pop-Location; $out
|
||||
}
|
||||
if ($r.Output -match "invalid domain|must be a valid hostname") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 11.4: Domain Length Overflow
|
||||
$longDomain = ("a" * 60 + ".") * 5 + "com"
|
||||
$r = Run-Test "CFG-04" "Config" "Domain Length Overflow" "Setting domain to 300+ chars" "CWE-20" {
|
||||
Push-Location $configTestDir; $out = & $GY config set domain $longDomain 2>&1 | Out-String; Pop-Location; $out
|
||||
}
|
||||
if ($r.Output -match "too long|invalid domain|max 253") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
# CATEGORY 12: Delete Command Safety (NEW)
|
||||
# ─────────────────────────────────────────────────────────────────────
|
||||
Write-Host "`n`n══ CATEGORY 12: Delete Command Safety (NEW) ══" -ForegroundColor Yellow
|
||||
|
||||
# Test 12.1: Delete missing resource type
|
||||
$r = Run-Test "DEL-01" "Delete" "Delete Missing Resource Type" "Running delete without specifying app/project" "CWE-20" {
|
||||
& $GY delete 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "requires.*argument|usage|app\|project|Error") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 12.2: Delete with SQL injection in --id
|
||||
$r = Run-Test "DEL-02" "Delete" "Delete --id SQL Injection" "Attempting SQL injection via --id flag" "CWE-89" {
|
||||
& $GY delete app test --id "'; DROP TABLE apps; --" 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "invalid|error|must be.*UUID|parsing|uuid") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
# Test 12.3: Delete app with XSS payload name
|
||||
$r = Run-Test "DEL-03" "Delete" "Delete App Name XSS" "Attempting XSS in app name for delete" "CWE-20" {
|
||||
echo "N" | & $GY delete app '<script>alert(1)</script>' 2>&1 | Out-String
|
||||
}
|
||||
if ($r.Output -match "no app|not found|error|login|auth") { $r.Status = "PASS"; $passed++ } else { $r.Status = "FAIL"; $failed++ }
|
||||
$results += $r
|
||||
Write-Host " Result: $($r.Status)" -ForegroundColor $(if($r.Status -eq "PASS"){"Green"}else{"Red"})
|
||||
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# GENERATE REPORT
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
Write-Host "`n`n═══════════════════════════════════════════════════════════" -ForegroundColor Green
|
||||
Write-Host " RESULTS: $passed PASSED | $failed FAILED | $total TOTAL" -ForegroundColor $(if($failed -eq 0){"Green"}else{"Red"})
|
||||
Write-Host "═══════════════════════════════════════════════════════════" -ForegroundColor Green
|
||||
|
||||
# Calculate binary size safely
|
||||
$binarySize = "N/A"
|
||||
try { $binarySize = "$([math]::Round((Get-Item $GY).Length / 1MB, 2)) MB" } catch {}
|
||||
|
||||
# Build the markdown report
|
||||
$reportLines = @()
|
||||
$reportLines += "# Ghaymah CLI v2 - Release Candidate Security Report"
|
||||
$reportLines += ""
|
||||
$reportLines += "> **Date:** $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
|
||||
$reportLines += "> **Binary:** gy-windows-amd64-v2.exe ($binarySize stripped with -s -w -trimpath)"
|
||||
$reportLines += "> **Source Version:** v0.0.24 (latest from repository)"
|
||||
$reportLines += "> **Tester:** Automated Security and Regression Suite v3"
|
||||
$reportLines += "> **OS:** Windows $(([environment]::OSVersion.Version.Major))"
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$reportLines += ""
|
||||
$reportLines += "## Executive Summary"
|
||||
$reportLines += ""
|
||||
$reportLines += "| Metric | Value |"
|
||||
$reportLines += "|--------|-------|"
|
||||
$reportLines += "| **Total Tests** | $total |"
|
||||
$reportLines += "| **Passed** | $passed |"
|
||||
$reportLines += "| **Failed** | $failed |"
|
||||
$reportLines += "| **Pass Rate** | $([math]::Round(($passed / [math]::Max($total,1)) * 100, 1))% |"
|
||||
$reportLines += "| **Test Categories** | 12 |"
|
||||
$reportLines += "| **Regression Tests** | $(($results | Where-Object { $_.Category -in @('Input Validation','TLS/Proxy','Sensitive Files','Scanner','Symlink','Binary','Config','Auth','Detection') }).Count) |"
|
||||
$reportLines += "| **New Feature Tests** | $(($results | Where-Object { $_.Category -in @('Tunnel','Delete') -or $_.ID -match 'CFG-' }).Count) |"
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$reportLines += ""
|
||||
|
||||
# Severity distribution
|
||||
$reportLines += "## Test Distribution by Category"
|
||||
$reportLines += ""
|
||||
$reportLines += '```mermaid'
|
||||
$reportLines += "pie title Test Results Distribution"
|
||||
|
||||
$catGroups = $results | Group-Object -Property Category
|
||||
foreach ($g in $catGroups) {
|
||||
$catPassed = ($g.Group | Where-Object { $_.Status -match "PASS" }).Count
|
||||
$reportLines += " ""$($g.Name) ($catPassed/$($g.Count))"" : $($g.Count)"
|
||||
}
|
||||
$reportLines += '```'
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$reportLines += ""
|
||||
|
||||
# Regression Matrix
|
||||
$reportLines += "## Regression Status Matrix"
|
||||
$reportLines += ""
|
||||
$reportLines += "> [!IMPORTANT]"
|
||||
$reportLines += "> All previously patched vulnerabilities must show PASS status to confirm no regressions."
|
||||
$reportLines += ""
|
||||
$reportLines += "| # | Vulnerability | CWE/ATTACK | Fix Summary | Status |"
|
||||
$reportLines += "|---|--------------|------------|-------------|--------|"
|
||||
|
||||
$regressionMap = @(
|
||||
@{Name="Input Validation"; CWE="CWE-20"; Fix="Regex allowlist on app names"; IDs=@("CWE20-01","CWE20-02","CWE20-03","CWE20-04","CWE20-05","CWE20-06","CWE20-07","CWE20-08")},
|
||||
@{Name="TLS Pinning"; CWE="T1557"; Fix="4-pin Pinset + proxy bypass"; IDs=@("T1557-01","T1557-02","T1557-03","T1557-04")},
|
||||
@{Name="Sensitive Files"; CWE="CWE-538"; Fix="Interactive prompt for .env/.pem/.key"; IDs=@("CWE538-01","CWE538-02","CWE538-03","CWE538-04","CWE538-05")},
|
||||
@{Name="Pre-Deploy Scanner"; CWE="CWE-250/798"; Fix="Dockerfile linting + .dockerignore"; IDs=@("SCAN-01","SCAN-02","CWE798-01","SCAN-03","SCAN-04")},
|
||||
@{Name="Symlink Protection"; CWE="T1027"; Fix="filepath.EvalSymlinks boundary"; IDs=@("T1027-01","T1027-02")},
|
||||
@{Name="Binary Hardening"; CWE="CWE-200"; Fix="-s -w -trimpath"; IDs=@("BIN-01","BIN-02","BIN-03","BIN-04")},
|
||||
@{Name="Port/Config Validation"; CWE="CWE-20"; Fix="Range and regex checks"; IDs=@("PORT-01","PORT-02","PORT-03")},
|
||||
@{Name="Auth Security"; CWE="CWE-306"; Fix="Token required for operations"; IDs=@("AUTH-01","AUTH-02")},
|
||||
@{Name="Project Detection"; CWE="N/A"; Fix="Language-specific file detection"; IDs=@("DETECT-01","DETECT-02","DETECT-03","DETECT-04","DETECT-05","DETECT-06")}
|
||||
)
|
||||
|
||||
$i = 1
|
||||
foreach ($rm in $regressionMap) {
|
||||
$allPassed = $true
|
||||
foreach ($id in $rm.IDs) {
|
||||
$test = $results | Where-Object { $_.ID -eq $id }
|
||||
if ($test -and $test.Status -notmatch "PASS") { $allPassed = $false }
|
||||
}
|
||||
$status = if ($allPassed) { "✅ PASS" } else { "❌ FAIL" }
|
||||
$reportLines += "| $i | $($rm.Name) | ``$($rm.CWE)`` | $($rm.Fix) | $status |"
|
||||
$i++
|
||||
}
|
||||
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$reportLines += ""
|
||||
|
||||
# New Feature Security Posture
|
||||
$reportLines += "## New Feature Security Posture"
|
||||
$reportLines += ""
|
||||
$reportLines += "| Feature | Tests | Passed | Status |"
|
||||
$reportLines += "|---------|-------|--------|--------|"
|
||||
|
||||
$newFeatures = @(
|
||||
@{Name="Tunnel Endpoint Validation"; IDs=@("TUN-01","TUN-02","TUN-03","TUN-04")},
|
||||
@{Name="Config Env Injection"; IDs=@("CFG-01","CFG-02","CFG-03","CFG-04")},
|
||||
@{Name="Delete Command Safety"; IDs=@("DEL-01","DEL-02","DEL-03")}
|
||||
)
|
||||
|
||||
foreach ($nf in $newFeatures) {
|
||||
$nfTotal = $nf.IDs.Count
|
||||
$nfPassed = 0
|
||||
foreach ($id in $nf.IDs) {
|
||||
$test = $results | Where-Object { $_.ID -eq $id }
|
||||
if ($test -and $test.Status -match "PASS") { $nfPassed++ }
|
||||
}
|
||||
$status = if ($nfPassed -eq $nfTotal) { "✅ SECURE" } else { "⚠️ $nfPassed/$nfTotal" }
|
||||
$reportLines += "| $($nf.Name) | $nfTotal | $nfPassed | $status |"
|
||||
}
|
||||
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$reportLines += ""
|
||||
|
||||
# Detailed Results
|
||||
$reportLines += "## Detailed Test Results"
|
||||
$reportLines += ""
|
||||
|
||||
$currentCategory = ""
|
||||
foreach ($r in $results) {
|
||||
if ($r.Category -ne $currentCategory) {
|
||||
$currentCategory = $r.Category
|
||||
$reportLines += "### Category: $currentCategory"
|
||||
$reportLines += ""
|
||||
}
|
||||
|
||||
$statusMark = if ($r.Status -match "PASS") { "✅ PASS" } else { "❌ FAIL" }
|
||||
$reportLines += "#### [$statusMark] [$($r.ID)] $($r.Name)"
|
||||
$reportLines += ""
|
||||
$reportLines += "**Description:** $($r.Description)"
|
||||
if ($r.CWE -ne "N/A") { $reportLines += "**CWE/ATTACK:** ``$($r.CWE)``" }
|
||||
$reportLines += ""
|
||||
$reportLines += "**Status:** ``$($r.Status)``"
|
||||
$reportLines += ""
|
||||
$reportLines += "<details><summary>Output</summary>"
|
||||
$reportLines += ""
|
||||
$trimmedOutput = $r.Output.Trim()
|
||||
if ($trimmedOutput.Length -gt 2000) { $trimmedOutput = $trimmedOutput.Substring(0, 2000) + "`n... (truncated)" }
|
||||
$reportLines += '```'
|
||||
$reportLines += $trimmedOutput
|
||||
$reportLines += '```'
|
||||
$reportLines += ""
|
||||
$reportLines += "</details>"
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$reportLines += ""
|
||||
}
|
||||
|
||||
# Conclusion
|
||||
$reportLines += "## Conclusion"
|
||||
$reportLines += ""
|
||||
$reportLines += "This automated Release Candidate test suite verified **$total security scenarios** across **12 categories**:"
|
||||
$reportLines += ""
|
||||
$reportLines += "### Regression Tests (9 Categories)"
|
||||
$reportLines += "1. **CWE-20 (Input Validation):** SQL injection, XSS, path traversal, unicode, null bytes, buffer overflow, and shell metacharacters."
|
||||
$reportLines += "2. **T1557 (TLS Pinning):** Proxy detection, proxy bypass, and pinset completeness (4 pins for graphql, auth, s3, logs)."
|
||||
$reportLines += "3. **CWE-538 (Sensitive Files):** Detection of .env, .pem, .key, id_rsa, and secrets.json."
|
||||
$reportLines += "4. **Pre-Deploy Scanner:** Dockerfile linting for root user, wildcard COPY, ENV secrets, and .dockerignore patterns."
|
||||
$reportLines += "5. **T1027 (Symlink Protection):** External symlink blocking and internal symlink allowance."
|
||||
$reportLines += "6. **Binary Hardening:** Size optimization, path obfuscation (-trimpath), and DWARF symbol stripping."
|
||||
$reportLines += "7. **Port/Config Validation:** Invalid ports (0, 99999) and invalid tiers."
|
||||
$reportLines += "8. **Auth Security:** Unauthenticated access and deploy without login."
|
||||
$reportLines += "9. **Project Auto-Detection:** Node.js, Python, Go, Static HTML, Dockerfile, and empty directory handling."
|
||||
$reportLines += ""
|
||||
$reportLines += "### New Feature Tests (3 Categories)"
|
||||
$reportLines += "10. **Tunnel Endpoint Validation:** SQL injection, XSS, path traversal, and buffer overflow in tunnel names."
|
||||
$reportLines += "11. **Config Set Injection:** GY_AI_KEY protection, malicious env keys, domain XSS, and domain length overflow."
|
||||
$reportLines += "12. **Delete Command Safety:** Missing resource type, --id SQL injection, and XSS in app names."
|
||||
$reportLines += ""
|
||||
$reportLines += "**Overall Pass Rate: $([math]::Round(($passed / [math]::Max($total,1)) * 100, 1))%**"
|
||||
$reportLines += ""
|
||||
$reportLines += "---"
|
||||
$dateStr = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
|
||||
$reportLines += "*Generated by the Ghaymah CLI v2 Release Candidate Security Test Suite v3 - $dateStr*"
|
||||
|
||||
$reportLines -join "`n" | Set-Content -Path $REPORT -Encoding UTF8
|
||||
Write-Host "`nReport saved to: $REPORT" -ForegroundColor Cyan
|
||||
المرجع في مشكلة جديدة
حظر مستخدم