24 lines
2.3 KiB
JavaScript
24 lines
2.3 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { createRequire } from 'node:module';
|
|
const require=createRequire(import.meta.url),{assertSecureStartup,BLOCKED_SWITCHES}=require('../apps/browser/startup-security.cjs');
|
|
const commandLine=names=>({hasSwitch:name=>new Set(names).has(name)});
|
|
test('managed startup rejects sandbox, extension, process-isolation and debugger bypass switches',()=>{
|
|
for(const name of BLOCKED_SWITCHES)assert.throws(()=>assertSecureStartup(commandLine([name]),[]),{message:'Unsafe browser startup configuration'},name);
|
|
});
|
|
test('managed startup permits normal Electron options and controlled local-agent actions',()=>{
|
|
assert.equal(assertSecureStartup(commandLine(['agent-action','agent-connection','user-data-dir','force-device-scale-factor','disable-gpu','enable-logging','lang']),[]),true);
|
|
assert.equal(assertSecureStartup(commandLine([]),['--trace-warnings','--max-old-space-size=4096']),true);
|
|
});
|
|
test('Node-consumed inspector flags are rejected without exposing host, port or other values',()=>{
|
|
for(const flag of ['--inspect=private.internal:9229','--inspect-brk=9229','--inspect-wait=0','--inspect-port=company-secret:5555','--debug','--debug-brk']){try{assertSecureStartup(commandLine([]),[flag]);assert.fail('Unsafe inspector flag accepted');}catch(error){assert.equal(error.message,'Unsafe browser startup configuration');assert.equal(error.message.includes(flag),false);}}
|
|
});
|
|
test('broken command-line adapters fail closed with a static error',()=>{
|
|
for(const adapter of [null,{}, {hasSwitch:()=>undefined},{hasSwitch:()=>{throw Error('private credential value');}}])assert.throws(()=>assertSecureStartup(adapter,[]),{message:'Unsafe browser startup configuration'});
|
|
assert.throws(()=>assertSecureStartup(commandLine([]),null),{message:'Unsafe browser startup configuration'});
|
|
assert.throws(()=>assertSecureStartup(commandLine([]),[{}]),{message:'Unsafe browser startup configuration'});
|
|
});
|
|
test('an already-active Node inspector is rejected even when no argv flag remains',()=>{
|
|
const inspector=require('node:inspector'),original=inspector.url;try{inspector.url=()=> 'ws://private-main-debugger.internal:9229/secret';assert.throws(()=>assertSecureStartup(commandLine([]),[]),{message:'Unsafe browser startup configuration'});}finally{inspector.url=original;}
|
|
});
|