115 lines
4.5 KiB
Bash
Executable File
115 lines
4.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
|
|
AUDIT="$SCRIPT_DIR/privacy_audit"
|
|
ROOT=$(mktemp -d "${TMPDIR:-/tmp}/privacy-audit-test.XXXXXX")
|
|
OUTSIDE=$(mktemp "${TMPDIR:-/tmp}/privacy-audit-outside.XXXXXX")
|
|
OUTSIDE_DIR=$(mktemp -d "${TMPDIR:-/tmp}/privacy-audit-outside-dir.XXXXXX")
|
|
TRACKED_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/privacy-audit-tracked.XXXXXX")
|
|
trap 'rm -rf "$ROOT" "$OUTSIDE" "$OUTSIDE_DIR" "$TRACKED_ROOT"' EXIT
|
|
|
|
fail() {
|
|
printf 'FAIL: %s\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
[ -x "$AUDIT" ] || fail 'privacy audit script missing or not executable'
|
|
|
|
mkdir -p "$ROOT/app" "$ROOT/docs"
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/app/forbidden.txt"
|
|
|
|
set +e
|
|
output=$(
|
|
python3 "$AUDIT" --root "$ROOT" 2>&1
|
|
)
|
|
status=$?
|
|
set -e
|
|
[ "$status" -ne 0 ] || fail 'forbidden URL must fail the audit'
|
|
printf '%s\n' "${output}" | grep -F 'app/forbidden.txt:1:hub-url' >/dev/null || fail 'audit did not report the forbidden file and line'
|
|
rm "$ROOT/app/forbidden.txt"
|
|
|
|
printf '%s\n' 'docs/audit-record.md' > "$ROOT/allowlist.txt"
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/docs/audit-record.md"
|
|
python3 "$AUDIT" --root "$ROOT" --allowlist-file "$ROOT/allowlist.txt" >/dev/null || fail 'explicitly allowlisted audit document must pass'
|
|
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$OUTSIDE"
|
|
set +e
|
|
outside_allowlist_status=$(python3 "$AUDIT" --root "$ROOT" --allowlist-file "$OUTSIDE" >/dev/null 2>&1)
|
|
outside_allowlist_exit=$?
|
|
set -e
|
|
[ "$outside_allowlist_exit" -eq 2 ] || fail 'allowlist outside root must return configuration error status 2'
|
|
rm "$ROOT/docs/audit-record.md"
|
|
ln -s "$OUTSIDE" "$ROOT/app/outside-link"
|
|
set +e
|
|
symlink_status=$(python3 "$AUDIT" --root "$ROOT" >/dev/null 2>&1)
|
|
symlink_exit=$?
|
|
set -e
|
|
[ "$symlink_exit" -eq 0 ] || fail 'audit must not follow a symlink outside the root'
|
|
|
|
mkdir -p "$ROOT/public"
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$OUTSIDE_DIR/bad.js"
|
|
ln -s "$OUTSIDE_DIR" "$ROOT/public/vite"
|
|
set +e
|
|
built_symlink_output=$(python3 "$AUDIT" --root "$ROOT" 2>&1)
|
|
built_symlink_exit=$?
|
|
set -e
|
|
[ "$built_symlink_exit" -eq 0 ] || fail 'audit must not traverse a symlinked built-artifact directory'
|
|
|
|
mkdir -p "$ROOT/public/assets"
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/public/assets/bundle.js"
|
|
set +e
|
|
built_output=$(python3 "$AUDIT" --root "$ROOT" 2>&1)
|
|
built_exit=$?
|
|
set -e
|
|
[ "$built_exit" -ne 0 ] || fail 'audit must scan a real built artifact'
|
|
printf '%s\n' "$built_output" | grep -F 'public/assets/bundle.js:1:hub-url' >/dev/null || fail 'audit did not report the built artifact finding'
|
|
rm "$ROOT/public/assets/bundle.js"
|
|
|
|
printf 'binary\0https://hub.2.chatwoot.com/ping\n' > "$ROOT/app/binary.dat"
|
|
set +e
|
|
binary_output=$(python3 "$AUDIT" --root "$ROOT" >/dev/null 2>&1)
|
|
binary_status=$?
|
|
set -e
|
|
[ "$binary_status" -eq 0 ] || fail 'binary files must be skipped without failing the audit'
|
|
rm "$ROOT/app/binary.dat"
|
|
|
|
mkdir -p "$TRACKED_ROOT/app"
|
|
git -C "$TRACKED_ROOT" init -q
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$OUTSIDE_DIR/tracked.js"
|
|
ln -s "$OUTSIDE_DIR" "$TRACKED_ROOT/app/generated"
|
|
git -C "$TRACKED_ROOT" add app/generated
|
|
set +e
|
|
tracked_symlink_output=$(python3 "$AUDIT" --root "$TRACKED_ROOT" 2>&1)
|
|
tracked_symlink_exit=$?
|
|
set -e
|
|
[ "$tracked_symlink_exit" -eq 0 ] || fail 'audit must ignore tracked symlinks escaping the root'
|
|
|
|
rm "$ROOT/app/outside-link"
|
|
printf '%s\n' 'https://hub.2.chatwoot.com/ping' > "$ROOT/app/forbidden.txt"
|
|
printf '%s\n' '../app/forbidden.txt' > "$ROOT/invalid-allowlist.txt"
|
|
set +e
|
|
invalid_allowlist_output=$(python3 "$AUDIT" --root "$ROOT" --allowlist-file "$ROOT/invalid-allowlist.txt" 2>&1)
|
|
invalid_allowlist_exit=$?
|
|
set -e
|
|
[ "$invalid_allowlist_exit" -eq 2 ] || fail 'non-relative allowlist entries must return configuration error status 2'
|
|
|
|
set +e
|
|
report_output=$(
|
|
python3 "$AUDIT" --root "$ROOT" --report-only 2>&1
|
|
)
|
|
report_status=$?
|
|
set -e
|
|
[ "$report_status" -eq 0 ] || fail 'report-only mode must not fail on known findings'
|
|
printf '%s\n' "$report_output" | grep -F 'app/forbidden.txt:1:hub-url' >/dev/null || fail 'report-only mode did not report the finding'
|
|
|
|
REPO_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
|
|
set +e
|
|
repo_report=$(python3 "$AUDIT" --root "$REPO_ROOT" --report-only 2>&1)
|
|
repo_status=$?
|
|
set -e
|
|
[ "$repo_status" -eq 0 ] || fail 'report-only mode must scan a git repository without crashing'
|
|
printf '%s\n' "$repo_report" | grep -F 'privacy_audit: REPORT-ONLY' >/dev/null || fail 'git-root report-only summary missing'
|
|
|
|
printf 'PASS: privacy audit harness\n'
|