open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

test(ast-taint): materialize the ast-scan fixtures at test time

Browse source 
The five Python taint fixtures under tests/fixtures/ast-scan/ move into
tests/helpers/payload-trees.mjs as the `ast-scan` tree, written to a temp
dir by the test like the three S1 trees. av-surface probe (d) gains the
directory: 5 -> 6 trees.

PM decision (S3 order): creds-net.py is os.environ -> requests.post, the
exfiltration shape AV classifiers are trained on; one rule, "no
payload-shaped runnable file on disk", is easier to defend than an
exception. The .py files match no SIG rule and are stored as plain lines.

Deviation from the order: it named three files (sinks, creds-net, scope);
the directory holds five (also reassign.py, sentinel.py). Gating the
directory means all five move.

Measured: (d) red first, d=1 (5 files) of 6 trees, then 0. sha256 of all
five on-disk files taken before git rm; payload-trees.test.mjs asserts
them, mutation-checked (one byte in creds-net.py -> red, restored
byte-identical). ast-taint-scanner.test.mjs 12/12 with the materialized
tree, both before and after the files were removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 14:11:27 +02:00
commit d5ff537599
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
8 changed files with 99 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/scanners/ast-taint-scanner.test.mjs
View file

@ -1,5 +1,6 @@
// ast-taint-scanner.test.mjs — Tests for the AST Python-taint scanner.
// Fixtures in tests/fixtures/ast-scan/:
// Fixtures: the `ast-scan` tree in tests/helpers/payload-trees.mjs, written to
// a temp dir at test time (S3, v8.1.0 — no payload-shaped .py on disk):
// - creds-net.py : os.environ -> variable -> requests.post (cross-statement taint)
// - scope.py : same var name in two functions, only one tainted (scope test)
// - reassign.py : tainted name rebound to a non-source value -> taint clears (#29)
@ -9,7 +10,7 @@
// python3-absent and malformed-input paths use throwaway temp dirs so they are
// deterministic regardless of the host having python3.
import { describe, it, beforeEach } from 'node:test';
import { describe, it, beforeEach, after } from 'node:test';
import assert from 'node:assert/strict';
import { resolve, join } from 'node:path';
import { fileURLToPath } from 'node:url';
@ -19,9 +20,12 @@ import { spawnSync } from 'node:child_process';
import { resetCounter } from '../../scanners/lib/output.mjs';
import { discoverFiles } from '../../scanners/lib/file-discovery.mjs';
import { scan } from '../../scanners/ast-taint-scanner.mjs';
import { materializeTree } from '../helpers/payload-trees.mjs';
const __dirname = fileURLToPath(new URL('.', import.meta.url));
const FIXTURE = resolve(__dirname, '../fixtures/ast-scan');
const fixtureTree = materializeTree('ast-scan');
after(fixtureTree.cleanup);
const FIXTURE = fixtureTree.dir;
// which-guard (mirrors vsix-sandbox.test.mjs): skip python3-dependent assertions
// when the interpreter is absent.