18 lines
1.6 KiB
JavaScript
18 lines
1.6 KiB
JavaScript
|
import test from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
import {defaultPolicy,inspect} from '../packages/core/policy.mjs';
|
||
|
|
import {inspectionTextVariants} from '../packages/core/text-variants.mjs';
|
||
|
|
test('literal secrets are detected in common nested wire encodings',()=>{
|
||
|
|
const p=defaultPolicy();p.dlp.rules=[{id:'company-secret',label:'Secret',kind:'literal',value:'PROJECT REDWOOD',action:'block'}];
|
||
|
|
const secret='PROJECT REDWOOD',b64=Buffer.from(secret).toString('base64');
|
||
|
|
for(const text of [secret,b64,JSON.stringify({payload:b64}),encodeURIComponent(encodeURIComponent(secret)),JSON.stringify({prompt:'PROJECT\u0020REDWOOD'}),Buffer.from(b64).toString('base64')])assert.equal(inspect(Buffer.from(text),p).ruleId,'company-secret',text);
|
||
|
|
for(const text of ['Public meeting agenda',JSON.stringify({prompt:'Public question',count:3}),'https://public.example/query?q=public+text'])assert.equal(inspect(Buffer.from(text),p).decision,'allow');
|
||
|
|
});
|
||
|
|
test('normalization is bounded and fails closed instead of skipping inspection',()=>{
|
||
|
|
const p=defaultPolicy();const text=JSON.stringify(Array.from({length:80},(_,i)=>`Public text ${i}`));
|
||
|
|
assert.equal(inspect(Buffer.from(text),p).ruleId,'normalization-limit');
|
||
|
|
assert.equal(inspect(Buffer.from(JSON.stringify(Array.from({length:5000},(_,i)=>i))),p).ruleId,'normalization-limit');
|
||
|
|
assert.throws(()=>inspectionTextVariants('Public text',2));
|
||
|
|
let nested='PROJECT REDWOOD';for(let i=0;i<4;i++)nested=Buffer.from(nested).toString('base64');
|
||
|
|
assert.equal(inspect(Buffer.from(nested),p).ruleId,'normalization-limit','Excessive encoding depth must not silently skip decoding');
|
||
|
|
});
|