forked from wangziqi/gongxue-base
60 lines
2.2 KiB
JavaScript
60 lines
2.2 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { spawnSync } from 'node:child_process';
|
|
|
|
const repoRoot = process.cwd();
|
|
const scriptPath = path.join(repoRoot, 'scripts', 'repo-security-scan.js');
|
|
|
|
function run(cwd) {
|
|
return spawnSync(process.execPath, [scriptPath, '--json'], {
|
|
cwd,
|
|
encoding: 'utf8',
|
|
env: {
|
|
PATH: process.env.PATH || '',
|
|
Path: process.env.Path || '',
|
|
SystemRoot: process.env.SystemRoot || '',
|
|
ComSpec: process.env.ComSpec || '',
|
|
TEMP: process.env.TEMP || os.tmpdir(),
|
|
TMP: process.env.TMP || os.tmpdir(),
|
|
},
|
|
});
|
|
}
|
|
|
|
const clean = run(repoRoot);
|
|
assert.equal(clean.status, 0, `current repository should pass security scan: ${clean.stdout} ${clean.stderr}`);
|
|
const cleanPayload = JSON.parse(clean.stdout);
|
|
assert.equal(cleanPayload.summary.critical, 0);
|
|
assert.equal(cleanPayload.summary.high, 0);
|
|
|
|
const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tiku-security-scan-'));
|
|
try {
|
|
fs.mkdirSync(path.join(tempDir, 'apps', 'taro', 'src'), { recursive: true });
|
|
fs.writeFileSync(
|
|
path.join(tempDir, 'apps', 'taro', 'src', 'unsafe.ts'),
|
|
"export const headers = { 'x-user-id': '123' };\n",
|
|
'utf8',
|
|
);
|
|
fs.writeFileSync(
|
|
path.join(tempDir, 'secret.env'),
|
|
[
|
|
'DATABASE_URL=postgresql://postgres:real-password@db.example.com:5432/postgres',
|
|
'SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake-service-role-token-that-should-not-ship',
|
|
'',
|
|
].join('\n'),
|
|
'utf8',
|
|
);
|
|
|
|
const unsafe = run(tempDir);
|
|
assert.notEqual(unsafe.status, 0, 'unsafe fixture should fail security scan');
|
|
const payload = JSON.parse(unsafe.stdout);
|
|
assert.ok(payload.findings.some(item => item.id === 'frontend-legacy-user-header'), 'x-user-id should be detected');
|
|
assert.ok(payload.findings.some(item => item.id === 'postgres-url'), 'database URL should be detected');
|
|
assert.ok(payload.findings.some(item => item.id === 'supabase-service-role'), 'service role key should be detected');
|
|
} finally {
|
|
fs.rmSync(tempDir, { recursive: true, force: true });
|
|
}
|
|
|
|
console.log('[PASS] repository security scan');
|