botium-core 1.13.19 → 1.14.0

package/test/security/allowUnsafe.spec.js

@@ -5,7 +5,6 @@ chai.use(chaiAsPromised)
 const assert = chai.assert
 const BotDriver = require('../../').BotDriver
 const Capabilities = require('../../').Capabilities
-const { BotiumError } = require('../../src/scripting/BotiumError')
 const HookUtils = require('../../src/helpers/HookUtils')
 
 const myCapsSimpleRest = {
@@ -17,21 +16,6 @@ const myCapsSimpleRest = {
   [Capabilities.SIMPLEREST_RESPONSE_JSONPATH]: ['$']
 }
 
-const echoConnector = ({ queueBotSays }) => {
-  return {
-    UserSays (msg) {
-      const botMsg = { sender: 'bot', sourceData: msg.sourceData, messageText: `You said: "${msg.messageText}"` }
-      queueBotSays(botMsg)
-    }
-  }
-}
-
-const myCapsEcho = {
-  [Capabilities.CONTAINERMODE]: echoConnector,
-  [Capabilities.SECURITY_ALLOW_UNSAFE]: false,
-  [Capabilities.SCRIPTING_ENABLE_MEMORY]: true
-}
-
 const _getSimpleRestCaps = (caps) => {
   return Object.assign(
     {},
@@ -57,11 +41,6 @@ const functionConnector = ({ queueBotSays }) => {
 
 describe('security.allowUnsafe', function () {
   describe('hook utils', function () {
-    it('should accept string hook in safe mode', async function () {
-      HookUtils.getHook({
-        [Capabilities.SECURITY_ALLOW_UNSAFE]: false
-      }, '1+1')
-    })
     it('should accept javascript hook in safe mode', async function () {
       HookUtils.getHook({
         [Capabilities.SECURITY_ALLOW_UNSAFE]: false
@@ -74,20 +53,26 @@ describe('security.allowUnsafe', function () {
         }, 'test/security/resources/hook-as-file.js')
         assert.fail('should have failed')
       } catch (err) {
-        assert.isTrue(err instanceof BotiumError)
-        assert.exists(err.context)
-        assert.equal(err.context.message, 'Security Error. Using unsafe custom hook with require is not allowed')
-        assert.equal(err.context.source, 'HookUtils.js')
-        assert.equal(err.context.type, 'security')
-        assert.equal(err.context.subtype, 'allow unsafe')
-        assert.exists(err.context.cause)
-        assert.equal(err.context.cause.hookData, 'test/security/resources/hook-as-file.js')
+        console.log(err.message)
+        assert.isTrue(err.message.indexOf('invalid') >= 0)
       }
     })
-    it('should accept file hook in unsafe mode', async function () {
+    it('should accept file hook from safe dir in unsafe mode', async function () {
       HookUtils.getHook({
-        [Capabilities.SECURITY_ALLOW_UNSAFE]: true
-      }, 'test/security/resources/hook-as-file.js')
+        [Capabilities.SECURITY_ALLOW_UNSAFE]: true,
+        [Capabilities.SAFEDIR]: 'test/security/'
+      }, 'resources/hook-as-file.js')
+    })
+    it('should not accept file hook from outside safe dir', async function () {
+      try {
+        HookUtils.getHook({
+          [Capabilities.SECURITY_ALLOW_UNSAFE]: true,
+          [Capabilities.SAFEDIR]: 'test/security/'
+        }, '../hook-as-file.js')
+        assert.fail('should have failed')
+      } catch (err) {
+        assert.isTrue(err.message.indexOf('invalid') >= 0)
+      }
     })
     it('should accept require hook in unsafe mode', async function () {
       HookUtils.getHook({
@@ -96,19 +81,6 @@ describe('security.allowUnsafe', function () {
     })
   })
 
-  describe('scripting memory', function () {
-    it('should not throw security error for using inline function', async function () {
-      const driver = new BotDriver(myCapsEcho)
-      const compiler = driver.BuildCompiler()
-      const container = await driver.Build()
-      await container.Start()
-
-      compiler.ReadScript(path.resolve(__dirname, 'convos'), 'withscriptingmemoryfunction.convo.txt')
-      await compiler.convos[0].Run(container)
-      await container.Clean()
-    }).timeout(50000)
-  })
-
   describe('simple rest, scripting memory', function () {
     it('should use variables succesful', async function () {
       const myCaps = _getSimpleRestCaps(
@@ -145,19 +117,6 @@ describe('security.allowUnsafe', function () {
   })
 
   describe('simple rest, hooks', function () {
-    it('should create and use simplerest with javascript hook', async function () {
-      const driver = new BotDriver(_getSimpleRestCaps(
-        {
-          [Capabilities.SIMPLEREST_REQUEST_HOOK]: '1+1'
-        }
-      ))
-
-      const compiler = driver.BuildCompiler()
-      const container = await driver.Build()
-      await container.Start()
-
-      compiler.ReadScript(path.resolve(__dirname, 'convos'), 'dummy.convo.txt')
-    })
     it('should create and use simplerest with function hooks', async function () {
       const driver = new BotDriver(_getSimpleRestCaps(
         {
@@ -173,35 +132,6 @@ describe('security.allowUnsafe', function () {
     })
   })
 
-  describe('precompilers', function () {
-    it('should not throw security error for inline script type', async function () {
-      const driver = new BotDriver(_getSimpleRestCaps(
-        {
-          [Capabilities.PRECOMPILERS]: {
-            NAME: 'SCRIPT',
-            SCRIPT: '1+1'
-          }
-        }
-      ))
-
-      const compiler = driver.BuildCompiler()
-      const container = await driver.Build()
-      const fileName = 'dummy.convo.txt'
-      compiler.ReadScript(path.resolve(__dirname, 'convos'), fileName)
-      assert.equal(compiler.convos.length, 1)
-      await container.Clean()
-    })
-  })
-
-  describe('base container, hooks', function () {
-    it('should not throw security error for using inline hook', async function () {
-      const driver = new BotDriver(_getSimpleRestCaps(
-        { [Capabilities.CUSTOMHOOK_ONUSERSAYS]: '1+1' }
-      ))
-      await driver.Build()
-    })
-  })
-
   describe('logic hook, asserter', function () {
     it('should load asserter from file', async function () {
       const driver = new BotDriver(_getSimpleRestCaps(
@@ -216,45 +146,6 @@ describe('security.allowUnsafe', function () {
 
       driver.BuildCompiler()
     })
-    it('should not throw security error for logic hook with inline src', async function () {
-      const driver = new BotDriver(_getSimpleRestCaps(
-        {
-          [Capabilities.LOGIC_HOOKS]: [
-            {
-              ref: 'MY-LOGICHOOK-NAME',
-              src: {
-                onMeStart: '1+1'
-              },
-              global: false,
-              args: {
-                'my-arg-1': 'something'
-              }
-            }
-          ]
-        }
-      ))
-
-      driver.BuildCompiler()
-    })
-    it('should not throw security error for global logic hook with inline src', async function () {
-      const driver = new BotDriver(_getSimpleRestCaps(
-        {
-          [Capabilities.LOGIC_HOOKS]: [
-            {
-              ref: 'MY-LOGICHOOK-NAME',
-              src: {
-                onMeStart: '1+1'
-              },
-              global: true,
-              args: {
-                'my-arg-1': 'something'
-              }
-            }
-          ]
-        }
-      ))
-      driver.BuildCompiler()
-    })
   })
 
   describe('connectors', function () {
@@ -270,10 +161,10 @@ describe('security.allowUnsafe', function () {
       })
       await driver.Build()
     })
-
-    it('should create any connector from file/dir, if its starts with botium-connector prefix', async function () {
+    it('should create any connector from safedir', async function () {
       const driver = new BotDriver({
-        [Capabilities.CONTAINERMODE]: 'botium-connector-as-file',
+        [Capabilities.SAFEDIR]: 'test/security/',
+        [Capabilities.CONTAINERMODE]: 'resources/botium-connector-as-file.js',
         [Capabilities.SECURITY_ALLOW_UNSAFE]: false
       })
       await driver.Build()