open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

test(ast-taint): materialize the ast-scan fixtures at test time

Browse source 
The five Python taint fixtures under tests/fixtures/ast-scan/ move into
tests/helpers/payload-trees.mjs as the `ast-scan` tree, written to a temp
dir by the test like the three S1 trees. av-surface probe (d) gains the
directory: 5 -> 6 trees.

PM decision (S3 order): creds-net.py is os.environ -> requests.post, the
exfiltration shape AV classifiers are trained on; one rule, "no
payload-shaped runnable file on disk", is easier to defend than an
exception. The .py files match no SIG rule and are stored as plain lines.

Deviation from the order: it named three files (sinks, creds-net, scope);
the directory holds five (also reassign.py, sentinel.py). Gating the
directory means all five move.

Measured: (d) red first, d=1 (5 files) of 6 trees, then 0. sha256 of all
five on-disk files taken before git rm; payload-trees.test.mjs asserts
them, mutation-checked (one byte in creds-net.py -> red, restored
byte-identical). ast-taint-scanner.test.mjs 12/12 with the materialized
tree, both before and after the files were removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 14:11:27 +02:00
commit d5ff537599
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
8 changed files with 99 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/av-surface.test.mjs
View file

@ -42,7 +42,8 @@
// byte in the first 8 KiB, the rule readTextFile uses) are outside the
// denominator: decoding compressed PNG/WOFF2 bytes as UTF-8 yields these
// codepoints by chance, and no reader ever sees them as characters.
// (d) any tracked file under a known payload tree.
// (d) any tracked file under a known payload tree (six since S3, which added
// tests/fixtures/ast-scan/).
// (a2) a test source (tests/**/*.mjs|.js, tests/golden/** excluded) whose RAW
// text holds a contiguous literal matching one of the same SIG rules.
// Raw bytes only, comments included: this is what sits on disk, and a
@ -103,6 +104,11 @@ const PAYLOAD_TREES = [
'tests/fixtures/trigger-scan/poisoned/',
'examples/malicious-skill-demo/evil-project-health/',
'examples/poisoned-claude-md/fixture/',
// S3 (2026-09-22, PM decision): Python taint fixtures. Not SIG payloads, but
// creds-net.py is os.environ -> requests.post, the exfiltration shape AV
// classifiers are trained on; "no payload-shaped runnable file on disk" is
// one rule, easier to defend than an exception.
'tests/fixtures/ast-scan/',
];
function trackedFiles() {