jodosjodos
39f03add71
- Introduced core files including Dockerfile, action.yml, and entry point script (bin/polinrider.js) for the PolinRider malware scanner. - Created configuration files: .env.example, .gitignore, and .npmrc for environment setup and dependency management. - Added CI workflows for testing, building, and releasing the action, along with examples for usage in GitHub Actions. - Implemented a README.md to provide documentation on usage, features, and setup instructions. - Included necessary scripts for building the action and handling security measures during execution. - Established a structured directory for reports and workspace management within Docker. - Ensured all files are set up for a secure and efficient scanning process of GitHub repositories for PolinRider malware.
34 lines
1.4 KiB
JavaScript
34 lines
1.4 KiB
JavaScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { execa } from "execa";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const probe = fileURLToPath(new URL("./_safety-probe.mjs", import.meta.url));
|
|
const entry = fileURLToPath(new URL("../src/index.js", import.meta.url));
|
|
|
|
test("Layer 3 in-code guards block eval / Function / vm / process.binding", async () => {
|
|
const r = await execa(process.execPath, [probe], { reject: false });
|
|
assert.equal(r.exitCode, 0, r.stderr || r.stdout);
|
|
assert.match(r.stdout, /safety-probe OK/);
|
|
});
|
|
|
|
test("Layer 2 V8 flag also blocks codegen (defense in depth)", async () => {
|
|
const r = await execa(process.execPath, ["--disallow-code-generation-from-strings", probe], {
|
|
reject: false,
|
|
});
|
|
assert.equal(r.exitCode, 0, r.stderr || r.stdout);
|
|
});
|
|
|
|
test("orchestrator imports cleanly under the hardening flag (dependency canary)", async () => {
|
|
// Import index.js (without running main) under the flag. If execa/chalk/ora or
|
|
// any transitive dep needs eval/new Function at import time, this exits non-zero.
|
|
const code = `await import(${JSON.stringify(entry)}); console.log("import OK");`;
|
|
const r = await execa(
|
|
process.execPath,
|
|
["--disallow-code-generation-from-strings", "--input-type=module", "-e", code],
|
|
{ reject: false },
|
|
);
|
|
assert.equal(r.exitCode, 0, r.stderr || r.stdout);
|
|
assert.match(r.stdout, /import OK/);
|
|
});
|