Harden Windows DLP enforcement and Electron runtime packaging

tests/text-variants.test.mjs

@@ -0,0 +1,18 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {defaultPolicy,inspect} from '../packages/core/policy.mjs';
+import {inspectionTextVariants} from '../packages/core/text-variants.mjs';
+test('literal secrets are detected in common nested wire encodings',()=>{
+ const p=defaultPolicy();p.dlp.rules=[{id:'company-secret',label:'Secret',kind:'literal',value:'PROJECT REDWOOD',action:'block'}];
+ const secret='PROJECT REDWOOD',b64=Buffer.from(secret).toString('base64');
+ for(const text of [secret,b64,JSON.stringify({payload:b64}),encodeURIComponent(encodeURIComponent(secret)),JSON.stringify({prompt:'PROJECT\u0020REDWOOD'}),Buffer.from(b64).toString('base64')])assert.equal(inspect(Buffer.from(text),p).ruleId,'company-secret',text);
+ for(const text of ['Public meeting agenda',JSON.stringify({prompt:'Public question',count:3}),'https://public.example/query?q=public+text'])assert.equal(inspect(Buffer.from(text),p).decision,'allow');
+});
+test('normalization is bounded and fails closed instead of skipping inspection',()=>{
+ const p=defaultPolicy();const text=JSON.stringify(Array.from({length:80},(_,i)=>`Public text ${i}`));
+ assert.equal(inspect(Buffer.from(text),p).ruleId,'normalization-limit');
+ assert.equal(inspect(Buffer.from(JSON.stringify(Array.from({length:5000},(_,i)=>i))),p).ruleId,'normalization-limit');
+ assert.throws(()=>inspectionTextVariants('Public text',2));
+ let nested='PROJECT REDWOOD';for(let i=0;i<4;i++)nested=Buffer.from(nested).toString('base64');
+ assert.equal(inspect(Buffer.from(nested),p).ruleId,'normalization-limit','Excessive encoding depth must not silently skip decoding');
+});