@mseep/open-computer-use 1.0.0

package/tests/security/test_safe_path_util.py

@@ -0,0 +1,166 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for security utilities: safe_path() and sanitize_chat_id()."""
+import inspect
+import sys
+from pathlib import Path
+
+import pytest
+from fastapi import HTTPException
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent / "computer-use-server"))
+
+import security
+from security import safe_path, sanitize_chat_id
+
+
+class TestSafePathImplementation:
+    """Verify safe_path() uses os.path pattern that CodeQL natively recognizes.
+
+    CodeQL py/path-injection does NOT recognize pathlib.Path.resolve() + is_relative_to()
+    as a containment check barrier (codeql issue #17226). It DOES natively recognize
+    os.path.realpath() + startswith() as a sanitizer without any model extensions.
+    """
+
+    def test_uses_os_path_realpath_not_pathlib_resolve(self):
+        """safe_path() must use os.path.realpath — CodeQL recognizes this as sanitizer."""
+        source = inspect.getsource(security.safe_path)
+        assert "os.path.realpath" in source, (
+            "safe_path() must use os.path.realpath() for CodeQL to suppress "
+            "py/path-injection false positives. pathlib.Path.resolve() + "
+            "is_relative_to() is NOT recognized by CodeQL as a containment barrier."
+        )
+
+    def test_uses_startswith_containment_check(self):
+        """safe_path() must use startswith() containment check — the CodeQL-recognized pattern."""
+        source = inspect.getsource(security.safe_path)
+        assert "startswith" in source, (
+            "safe_path() must use startswith() for the containment check. "
+            "is_relative_to() is not recognized by CodeQL py/path-injection."
+        )
+
+    def test_does_not_use_is_relative_to(self):
+        """safe_path() must NOT use is_relative_to() — CodeQL does not recognise it."""
+        source = inspect.getsource(security.safe_path)
+        assert "is_relative_to" not in source, (
+            "safe_path() uses pathlib is_relative_to() which CodeQL does not "
+            "recognise as a path containment sanitizer. Use os.path.realpath + startswith."
+        )
+
+
+class TestSafePath:
+    """Tests for safe_path() — path traversal protection."""
+
+    def test_normal_path(self, tmp_path):
+        base = tmp_path / "data"
+        base.mkdir()
+        (base / "file.txt").touch()
+        result = safe_path(base, "file.txt")
+        assert result == (base / "file.txt").resolve()
+
+    def test_subdirectory_path(self, tmp_path):
+        base = tmp_path / "data"
+        sub = base / "subdir"
+        sub.mkdir(parents=True)
+        (sub / "file.txt").touch()
+        result = safe_path(base, "subdir", "file.txt")
+        assert result == (sub / "file.txt").resolve()
+
+    def test_traversal_dot_dot(self, tmp_path):
+        base = tmp_path / "data"
+        base.mkdir()
+        with pytest.raises(HTTPException) as exc_info:
+            safe_path(base, "..", "..", "etc", "passwd")
+        assert exc_info.value.status_code == 403
+
+    def test_traversal_in_segment(self, tmp_path):
+        base = tmp_path / "data"
+        base.mkdir()
+        with pytest.raises(HTTPException) as exc_info:
+            safe_path(base, "../../etc/passwd")
+        assert exc_info.value.status_code == 403
+
+    def test_absolute_path_injection(self, tmp_path):
+        base = tmp_path / "data"
+        base.mkdir()
+        with pytest.raises(HTTPException) as exc_info:
+            safe_path(base, "/etc/passwd")
+        assert exc_info.value.status_code == 403
+
+    def test_string_prefix_false_positive(self, tmp_path):
+        """Base /data should NOT match /data-evil."""
+        base = tmp_path / "data"
+        base.mkdir()
+        evil = tmp_path / "data-evil"
+        evil.mkdir()
+        (evil / "file.txt").touch()
+        with pytest.raises(HTTPException) as exc_info:
+            safe_path(base, "..", "data-evil", "file.txt")
+        assert exc_info.value.status_code == 403
+
+    def test_nonexistent_file_ok(self, tmp_path):
+        """safe_path should work for files that don't exist yet (upload case)."""
+        base = tmp_path / "data"
+        base.mkdir()
+        result = safe_path(base, "newfile.txt")
+        assert result == (base / "newfile.txt").resolve()
+
+    def test_symlink_escape(self, tmp_path):
+        """Symlink pointing outside base should be rejected."""
+        base = tmp_path / "data"
+        base.mkdir()
+        secret = tmp_path / "secret"
+        secret.mkdir()
+        (secret / "key.txt").touch()
+        (base / "link").symlink_to(secret)
+        with pytest.raises(HTTPException) as exc_info:
+            safe_path(base, "link", "key.txt")
+        assert exc_info.value.status_code == 403
+
+
+class TestSanitizeChatId:
+    """Tests for sanitize_chat_id() — chat_id validation."""
+
+    def test_valid_uuid(self):
+        result = sanitize_chat_id("A1B2C3D4-E5F6-7890-ABCD-EF1234567890")
+        assert result == "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+
+    def test_default_string(self):
+        assert sanitize_chat_id("default") == "default"
+
+    def test_arbitrary_string(self):
+        assert sanitize_chat_id("my-session-123") == "my-session-123"
+
+    def test_traversal_dot_dot(self):
+        with pytest.raises(HTTPException) as exc_info:
+            sanitize_chat_id("../../etc")
+        assert exc_info.value.status_code == 400
+
+    def test_slash(self):
+        with pytest.raises(HTTPException) as exc_info:
+            sanitize_chat_id("abc/def")
+        assert exc_info.value.status_code == 400
+
+    def test_backslash(self):
+        with pytest.raises(HTTPException) as exc_info:
+            sanitize_chat_id("abc\\def")
+        assert exc_info.value.status_code == 400
+
+    def test_empty_string(self):
+        with pytest.raises(HTTPException) as exc_info:
+            sanitize_chat_id("")
+        assert exc_info.value.status_code == 400
+
+    def test_whitespace_only(self):
+        with pytest.raises(HTTPException) as exc_info:
+            sanitize_chat_id("   ")
+        assert exc_info.value.status_code == 400
+
+    def test_null_byte(self):
+        with pytest.raises(HTTPException) as exc_info:
+            sanitize_chat_id("chat\x00id")
+        assert exc_info.value.status_code == 400
+
+    def test_whitespace_trimming(self):
+        result = sanitize_chat_id("  my-chat  ")
+        assert result == "my-chat"

package/tests/security/test_xss_preview.py

@@ -0,0 +1,46 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for XSS protection in _generate_preview_html."""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent / "computer-use-server"))
+
+from app import _generate_preview_html
+
+
+VALID_CHAT_ID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+
+
+class TestPreviewXSS:
+    def test_script_injection_in_chat_id(self):
+        """chat_id with JS break-out should be escaped so quotes don't terminate the string."""
+        html = _generate_preview_html('";alert(1);//', "/api", "/files")
+        # The unescaped pattern would create: chatId: "";alert(1);//"
+        # With json.dumps it becomes: chatId: "\";alert(1);//" (safe)
+        assert 'chatId: "";alert(1)' not in html
+
+    def test_closing_script_tag_escaped(self):
+        """</script> in chat_id must not close the script block."""
+        html = _generate_preview_html('</script><script>alert(1)</script>', "/api", "/files")
+        # json.dumps produces: "</script><script>alert(1)</script>"
+        # This is still inside a JS string, but a naive HTML parser would close the block.
+        # The real fix is sanitize_chat_id (rejects / in chat_id), but let's verify
+        # the value is inside a JSON string context (wrapped by json.dumps quotes).
+        # With old f-string: chatId: "</script>... — parser closes <script> block = XSS
+        # With json.dumps: chatId: "</script>... — still JSON string, but browsers
+        # may still parse </script> as tag close. Full protection comes from sanitize_chat_id.
+        # Verify json.dumps is being used (presence of escaped quotes pattern)
+        assert 'chatId: "' in html  # json.dumps adds quotes
+
+    def test_normal_chat_id(self):
+        html = _generate_preview_html(VALID_CHAT_ID, "/api/outputs/x", "/files/x")
+        assert VALID_CHAT_ID in html
+
+    def test_values_use_json_dumps(self):
+        """All config values should be properly JSON-encoded (not raw f-string interpolation)."""
+        html = _generate_preview_html("test-id", "/api/test", "/files/test")
+        # json.dumps adds its own quotes, so the pattern should be: chatId: "test-id"
+        assert 'chatId: "test-id"' in html
+        assert 'apiUrl: "/api/test"' in html
+        assert 'filesBase: "/files/test"' in html

package/tests/test-default-model-resolution.py

@@ -0,0 +1,136 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Unit tests for cli_runtime.resolve_subagent_model resolution order.
+
+Phase 1 D-08/D-09 introduced per-CLI defaults. Phase 2 D-01/D-02 (CONTEXT.md
+phases/02-...) DROPPED the hardcoded defaults for opencode and codex; only
+claude retains a hardcoded fallback.
+
+Updated resolution priority:
+  caller-supplied alias/id > <CLI>_SUB_AGENT_DEFAULT_MODEL env > per-CLI fallback
+
+Per-CLI fallback behavior (Phase 2):
+  - claude  → expansion of 'sonnet' via _CLAUDE_ALIAS_MAP (hardcoded baseline preserved)
+  - opencode → raises ValueError (no hardcoded baseline; explicit error guides operator)
+  - codex   → raises ValueError (no hardcoded baseline; explicit error guides operator)
+"""
+
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "computer-use-server"))
+
+# We import only the resolver and alias maps; avoid pulling in FastMCP / docker SDK
+# at module-parse time by importing lazily inside each test via the function references.
+import cli_runtime
+from cli_runtime import Cli, resolve_subagent_model, _CLAUDE_ALIAS_MAP
+
+
+# ===========================================================================
+# Claude
+# ===========================================================================
+
+def test_claude_default(monkeypatch):
+    """Empty alias with claude CLI resolves to the canonical sonnet expansion."""
+    # Clear any env overrides that could affect ANTHROPIC_DEFAULT_SONNET_MODEL
+    monkeypatch.delenv("CLAUDE_SUB_AGENT_DEFAULT_MODEL", raising=False)
+    model_id, _display = resolve_subagent_model("", Cli.CLAUDE)
+    expected = _CLAUDE_ALIAS_MAP["sonnet"]()
+    assert model_id == expected, (
+        f"Expected claude default '{expected}', got '{model_id}'"
+    )
+
+
+def test_claude_caller_wins(monkeypatch):
+    """Caller-supplied alias takes priority over default for claude CLI."""
+    monkeypatch.delenv("CLAUDE_SUB_AGENT_DEFAULT_MODEL", raising=False)
+    model_id, display = resolve_subagent_model("opus", Cli.CLAUDE)
+    expected = _CLAUDE_ALIAS_MAP["opus"]()
+    assert model_id == expected, (
+        f"Expected opus expansion '{expected}', got '{model_id}'"
+    )
+
+
+# ===========================================================================
+# opencode
+# ===========================================================================
+
+def test_opencode_no_default_raises(monkeypatch):
+    """Phase 2 D-02: opencode has NO hardcoded default; raises ValueError when caller
+    passes empty alias and no OPENCODE_SUB_AGENT_DEFAULT_MODEL env is set.
+
+    The error message must point the operator at list-subagent-models and the env var.
+    """
+    monkeypatch.delenv("OPENCODE_SUB_AGENT_DEFAULT_MODEL", raising=False)
+    monkeypatch.delenv("OPENCODE_MODEL", raising=False)
+    monkeypatch.delenv("OPENCODE_MODEL_ALIASES", raising=False)
+    with pytest.raises(ValueError) as exc_info:
+        resolve_subagent_model("", Cli.OPENCODE)
+    msg = str(exc_info.value)
+    assert "OPENCODE_SUB_AGENT_DEFAULT_MODEL" in msg, msg
+    assert "list-subagent-models" in msg, msg
+
+
+def test_opencode_env_default(monkeypatch):
+    """OPENCODE_SUB_AGENT_DEFAULT_MODEL env overrides hardcoded default."""
+    monkeypatch.setenv("OPENCODE_SUB_AGENT_DEFAULT_MODEL", "openrouter/qwen/qwen-3-coder")
+    monkeypatch.delenv("OPENCODE_MODEL", raising=False)
+    monkeypatch.delenv("OPENCODE_MODEL_ALIASES", raising=False)
+    model_id, _display = resolve_subagent_model("", Cli.OPENCODE)
+    assert model_id == "openrouter/qwen/qwen-3-coder", (
+        f"Expected env-driven opencode default 'openrouter/qwen/qwen-3-coder', got '{model_id}'"
+    )
+
+
+def test_opencode_alias_override_via_env(monkeypatch):
+    """OPENCODE_MODEL_ALIASES can add custom aliases that caller can use."""
+    monkeypatch.setenv(
+        "OPENCODE_MODEL_ALIASES", '{"qwen": "openrouter/qwen/qwen-3-coder"}'
+    )
+    monkeypatch.delenv("OPENCODE_SUB_AGENT_DEFAULT_MODEL", raising=False)
+    monkeypatch.delenv("OPENCODE_MODEL", raising=False)
+    model_id, _display = resolve_subagent_model("qwen", Cli.OPENCODE)
+    assert model_id == "openrouter/qwen/qwen-3-coder", (
+        f"Expected alias-expanded id 'openrouter/qwen/qwen-3-coder', got '{model_id}'"
+    )
+
+
+# ===========================================================================
+# codex
+# ===========================================================================
+
+def test_codex_no_default_raises(monkeypatch):
+    """Phase 2 D-02: codex has NO hardcoded default; raises ValueError when caller
+    passes empty alias and no CODEX_SUB_AGENT_DEFAULT_MODEL env is set.
+
+    The error message must point the operator at list-subagent-models and the env var.
+    """
+    monkeypatch.delenv("CODEX_SUB_AGENT_DEFAULT_MODEL", raising=False)
+    monkeypatch.delenv("CODEX_MODEL", raising=False)
+    with pytest.raises(ValueError) as exc_info:
+        resolve_subagent_model("", Cli.CODEX)
+    msg = str(exc_info.value)
+    assert "CODEX_SUB_AGENT_DEFAULT_MODEL" in msg, msg
+    assert "list-subagent-models" in msg, msg
+
+
+def test_codex_env_default(monkeypatch):
+    """CODEX_SUB_AGENT_DEFAULT_MODEL env overrides hardcoded default."""
+    monkeypatch.setenv("CODEX_SUB_AGENT_DEFAULT_MODEL", "gpt-4o")
+    monkeypatch.delenv("CODEX_MODEL", raising=False)
+    model_id, _display = resolve_subagent_model("", Cli.CODEX)
+    assert model_id == "gpt-4o", (
+        f"Expected env-driven codex default 'gpt-4o', got '{model_id}'"
+    )
+
+
+def test_caller_wins_over_env(monkeypatch):
+    """Caller-supplied id beats env default for codex CLI."""
+    monkeypatch.setenv("CODEX_SUB_AGENT_DEFAULT_MODEL", "gpt-4o")
+    monkeypatch.delenv("CODEX_MODEL", raising=False)
+    model_id, _display = resolve_subagent_model("o3", Cli.CODEX)
+    assert model_id == "o3", (
+        f"Expected caller-supplied 'o3' to win over env default, got '{model_id}'"
+    )