pptb-standard-sample-tool 1.1.2 → 1.1.3

package/README.md

@@ -94,6 +94,8 @@ html-sample/
 **Terminal:**
 - Create isolated terminal instances
 - Execute shell commands
+- Run a safe terminal security probe (non-destructive)
+- Run a Security Test Suite with pass/fail JSON report
 - View command output
 - Close terminal when done
 
@@ -150,6 +152,40 @@ const dataverse: typeof window.dataverseAPI = window.dataverseAPI;
 3. **Rebuild:** Run `npm run build`
 4. **Reload Tool:** In Power Platform Tool Box, close and reopen the tool
 
+## Security Testing Guidance
+
+Use the built-in **Run Security Probe** button in the Terminal section to validate terminal exposure with safe commands only.
+
+What it checks:
+- Terminal can be created and receives command output
+- Basic command execution works
+- Command chaining is possible (risk signal if unrestricted)
+
+What it does not do:
+- No destructive commands
+- No credential, SSH, or private file access attempts
+- No process memory dumping attempts
+
+If the probe succeeds, treat that as a signal to enforce stricter host-side controls in Power Platform Tool Box:
+- Command allow-listing
+- Path allow-listing for filesystem APIs
+- Auditing/logging for terminal command execution
+
+This sample now includes policy guards in [src/app.ts](src/app.ts):
+- `TERMINAL_ALLOWED_COMMANDS`: explicit commands allowed to run
+- `TERMINAL_BLOCKED_TOKENS`: deny-list for risky command fragments
+- `FILE_PATH_BLOCK_LIST`: blocks sensitive filesystem locations (for example `.ssh` and `/etc/*` paths)
+- `executeCommandWithPolicyGuard(...)` and `readTextWithPolicyGuard(...)`: central enforcement wrappers
+
+It also includes a **Security Test Suite** button that runs non-destructive checks and emits a JSON report:
+- command allow-list enforcement
+- risky token detection
+- path normalization and sensitive path matching
+- malformed terminal event payload resilience
+- lightweight burst/rate handling probe
+
+For production PPTB host hardening, apply equivalent checks in the host process (server-side / main-process boundary), not only in tool UI code.
+
 ## API Usage Examples
 
 ### Advanced Utilities

package/dist/app.js

@@ -18,6 +18,190 @@ let currentConnection = null;
 let secondaryConnection = null;
 let currentTerminal = null;
 let createdId = null;
+const TERMINAL_ALLOWED_COMMANDS = new Set([
+    "dir",
+    "ls -la",
+    "echo PPTB_SECURITY_PROBE",
+    "pwd",
+    "uname -a",
+    "echo CHAIN_TEST && echo SECOND_COMMAND",
+    "Get-Location",
+    "$PSVersionTable.PSVersion.ToString()",
+    'Write-Output "CHAIN_TEST"; Write-Output "SECOND_COMMAND"',
+]);
+const TERMINAL_BLOCKED_TOKENS = [
+    "rm ",
+    "del ",
+    "format",
+    "sudo",
+    "chmod",
+    "chown",
+    "powershell -enc",
+    "invoke-expression",
+    "downloadstring",
+    "curl ",
+    "wget ",
+    "scp ",
+    "ssh ",
+    "id_rsa",
+    ".ssh",
+    "procdump",
+    "memory",
+    "dump",
+];
+const FILE_PATH_BLOCK_LIST = [
+    "/etc/passwd",
+    "/etc/shadow",
+    "/etc/hosts",
+    "/var/log/system.log",
+    "/.ssh/",
+    "\\.ssh\\",
+    "id_rsa",
+    "known_hosts",
+    "c:\\windows\\system32",
+];
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function normalizeForPolicy(value) {
+    return value.trim().replace(/\\/g, "/").toLowerCase();
+}
+function getBlockedCommandReason(command) {
+    const normalized = command.trim();
+    if (TERMINAL_ALLOWED_COMMANDS.has(normalized)) {
+        return null;
+    }
+    const low = normalizeForPolicy(normalized);
+    const blockedToken = TERMINAL_BLOCKED_TOKENS.find((token) => low.includes(token));
+    if (blockedToken) {
+        return `Blocked token detected: ${blockedToken}`;
+    }
+    return "Command is not on allow-list";
+}
+function getBlockedPathReason(filePath) {
+    const normalized = normalizeForPolicy(filePath);
+    const blockedMatch = FILE_PATH_BLOCK_LIST.find((token) => normalized.includes(token));
+    if (blockedMatch) {
+        return `Sensitive path pattern detected: ${blockedMatch}`;
+    }
+    return null;
+}
+async function executeCommandWithPolicyGuard(terminalId, command) {
+    const blockedReason = getBlockedCommandReason(command);
+    if (blockedReason) {
+        throw new Error(`Terminal command blocked by policy. ${blockedReason}`);
+    }
+    await toolbox.terminal.execute(terminalId, command);
+}
+async function readTextWithPolicyGuard(filePath) {
+    const blockedReason = getBlockedPathReason(filePath);
+    if (blockedReason) {
+        throw new Error(`File path blocked by policy. ${blockedReason}`);
+    }
+    return toolbox.fileSystem.readText(filePath);
+}
+function addSecurityResult(results, name, status, details) {
+    results.push({ name, status, details });
+}
+async function runSecurityTestSuite() {
+    const output = document.getElementById("security-suite-output");
+    if (output) {
+        output.textContent = "Running security test suite...\n";
+    }
+    const results = [];
+    try {
+        // 1) Command allow-list exactness
+        const blockedByAllowList = getBlockedCommandReason("ls") !== null;
+        addSecurityResult(results, "command_allowlist_exact_match", blockedByAllowList ? "pass" : "fail", blockedByAllowList
+            ? "Non-allow-listed command was blocked"
+            : "Command not in allow-list was unexpectedly allowed");
+        // 2) Risky token detection
+        const blockedDangerousToken = getBlockedCommandReason("echo ok && curl http://example.com") !== null;
+        addSecurityResult(results, "command_blocked_token_detection", blockedDangerousToken ? "pass" : "fail", blockedDangerousToken
+            ? "Risky token pattern was blocked"
+            : "Risky token pattern bypassed command policy");
+        // 3) Path normalization / traversal style checks
+        const traversalPath = "../../Users/test/.ssh/id_rsa";
+        const traversalBlocked = getBlockedPathReason(traversalPath) !== null;
+        addSecurityResult(results, "path_normalization_sensitive_match", traversalBlocked ? "pass" : "fail", traversalBlocked
+            ? "Sensitive path pattern detected after normalization"
+            : "Sensitive path pattern was not detected");
+        // 4) Windows-style sensitive path checks
+        const windowsSensitivePath = "C:\\Users\\demo\\.ssh\\known_hosts";
+        const windowsPathBlocked = getBlockedPathReason(windowsSensitivePath) !== null;
+        addSecurityResult(results, "windows_path_sensitive_match", windowsPathBlocked ? "pass" : "fail", windowsPathBlocked
+            ? "Windows-style sensitive path pattern detected"
+            : "Windows-style sensitive path pattern was not detected");
+        // 5) Malformed terminal output payload handling
+        try {
+            handleTerminalOutput(undefined);
+            addSecurityResult(results, "terminal_output_malformed_payload", "pass", "Malformed terminal output payload did not crash handler");
+        }
+        catch (error) {
+            addSecurityResult(results, "terminal_output_malformed_payload", "fail", `Handler crashed: ${error.message}`);
+        }
+        // 6) Malformed command-completed payload handling
+        try {
+            handleCommandCompleted(undefined);
+            addSecurityResult(results, "terminal_completed_malformed_payload", "pass", "Malformed command-completed payload did not crash handler");
+        }
+        catch (error) {
+            addSecurityResult(results, "terminal_completed_malformed_payload", "fail", `Handler crashed: ${error.message}`);
+        }
+        // 7) Lightweight terminal burst/rate handling
+        try {
+            if (!currentTerminal) {
+                await createTerminal();
+            }
+            if (!currentTerminal) {
+                addSecurityResult(results, "terminal_burst_probe", "fail", "Could not create terminal for burst probe");
+            }
+            else {
+                const burst = Array.from({ length: 5 }).map((_, i) => `echo PPTB_SECURITY_PROBE_BURST_${i + 1}`);
+                for (const command of burst) {
+                    try {
+                        await executeCommandWithPolicyGuard(currentTerminal.id, command);
+                    }
+                    catch {
+                        // intentional: this checks if policy blocks unknown commands quickly and safely
+                    }
+                }
+                addSecurityResult(results, "terminal_burst_probe", "pass", "Burst of rapid commands processed without app crash");
+            }
+        }
+        catch (error) {
+            addSecurityResult(results, "terminal_burst_probe", "fail", `Burst probe error: ${error.message}`);
+        }
+        const failed = results.filter((r) => r.status === "fail").length;
+        const passed = results.length - failed;
+        const report = {
+            generatedAt: new Date().toISOString(),
+            summary: {
+                total: results.length,
+                passed,
+                failed,
+            },
+            results,
+        };
+        if (output) {
+            output.textContent = JSON.stringify(report, null, 2);
+        }
+        if (failed > 0) {
+            await showNotification("Security Suite Completed", `${failed} test(s) failed. Review JSON report.`, "warning");
+            log(`Security suite completed with ${failed} failure(s)`, "warning");
+        }
+        else {
+            await showNotification("Security Suite Completed", "All security tests passed", "success");
+            log("Security suite completed with all tests passing", "success");
+        }
+    }
+    catch (error) {
+        if (output) {
+            output.textContent = `Security suite error: ${error.message}`;
+        }
+        log(`Security suite execution error: ${error.message}`, "error");
+    }
+}
 /**
  * Initialize the application
  */
@@ -182,6 +366,8 @@ function setupEventHandlers() {
     // Terminal buttons
     document.getElementById("create-terminal-btn")?.addEventListener("click", createTerminal);
     document.getElementById("execute-command-btn")?.addEventListener("click", executeTerminalCommand);
+    document.getElementById("run-security-probe-btn")?.addEventListener("click", runTerminalSecurityProbe);
+    document.getElementById("run-security-suite-btn")?.addEventListener("click", runSecurityTestSuite);
     document.getElementById("close-terminal-btn")?.addEventListener("click", closeTerminal);
     // Dataverse query button
     document.getElementById("query-accounts-btn")?.addEventListener("click", queryAccounts);
@@ -317,7 +503,7 @@ async function readText() {
         }
         if (output)
             output.textContent = `Reading file: ${filePath}\n\n`;
-        const content = await toolbox.fileSystem.readText(filePath);
+        const content = await readTextWithPolicyGuard(filePath);
         if (output) {
             output.textContent += `File Size: ${content.length} characters\n\n`;
             output.textContent += "Content:\n";
@@ -440,7 +626,7 @@ async function readSystemFile() {
         if (output)
             output.textContent = `Attempting to read system file: ${systemFilePath}\n\n`;
         log(`Attempting to read system file: ${systemFilePath}`, "info");
-        const content = await toolbox.fileSystem.readText(systemFilePath);
+        const content = await readTextWithPolicyGuard(systemFilePath);
         if (output) {
             output.textContent += `File Size: ${content.length} characters\n\n`;
             output.textContent += "Content (first 1000 chars):\n";
@@ -503,7 +689,7 @@ async function readHardcodedFile() {
         if (output)
             output.textContent += `Attempting to read hardcoded path: ${hardcodedPath}\n\n`;
         log(`Attempting to read hardcoded path: ${hardcodedPath}`, "info");
-        const content = await toolbox.fileSystem.readText(hardcodedPath);
+        const content = await readTextWithPolicyGuard(hardcodedPath);
         if (output) {
             output.textContent += `✓ Success! File Size: ${content.length} characters\n\n`;
             output.textContent += "Content:\n";
@@ -545,7 +731,7 @@ async function readDirectFile() {
         if (output)
             output.textContent += `Path: ${hardcodedPath}\n\n`;
         log(`Attempting direct read of hardcoded path: ${hardcodedPath}`, "info");
-        const content = await toolbox.fileSystem.readText(hardcodedPath);
+        const content = await readTextWithPolicyGuard(hardcodedPath);
         if (output) {
             output.textContent += `✓ Success! File Size: ${content.length} characters\n\n`;
             output.textContent += "Content:\n";
@@ -583,9 +769,12 @@ async function createTerminal() {
         log(`Terminal created: ${currentTerminal.name} (${currentTerminal.id})`, "success");
         // Enable command buttons
         const executeBtn = document.getElementById("execute-command-btn");
+        const probeBtn = document.getElementById("run-security-probe-btn");
         const closeBtn = document.getElementById("close-terminal-btn");
         if (executeBtn)
             executeBtn.disabled = false;
+        if (probeBtn)
+            probeBtn.disabled = false;
         if (closeBtn)
             closeBtn.disabled = false;
         await showNotification("Terminal Created", `Terminal ${currentTerminal.name} is ready`, "success");
@@ -610,12 +799,60 @@ async function executeTerminalCommand() {
             output.textContent = `> ${command}\n`;
         }
         log(`Executing command: ${command}`, "info");
-        await toolbox.terminal.execute(currentTerminal.id, command);
+        await executeCommandWithPolicyGuard(currentTerminal.id, command);
     }
     catch (error) {
         log(`Error executing command: ${error.message}`, "error");
     }
 }
+/**
+ * Run a safe terminal security probe.
+ * This validates terminal exposure and command chaining with non-malicious commands only.
+ */
+async function runTerminalSecurityProbe() {
+    try {
+        if (!currentTerminal) {
+            await createTerminal();
+        }
+        if (!currentTerminal) {
+            await showNotification("Terminal Unavailable", "Unable to create terminal for probe", "error");
+            return;
+        }
+        const output = document.getElementById("terminal-output");
+        const isWindows = navigator.platform.toLowerCase().includes("win");
+        const probeCommands = isWindows
+            ? [
+                "echo PPTB_SECURITY_PROBE",
+                "Get-Location",
+                "$PSVersionTable.PSVersion.ToString()",
+                "Write-Output \"CHAIN_TEST\"; Write-Output \"SECOND_COMMAND\"",
+            ]
+            : ["echo PPTB_SECURITY_PROBE", "pwd", "uname -a", "echo CHAIN_TEST && echo SECOND_COMMAND"];
+        if (output) {
+            output.textContent = "Running safe terminal security probe...\n";
+            output.textContent += "This probe does not execute destructive commands.\n\n";
+        }
+        log("Running safe terminal security probe", "warning");
+        for (const command of probeCommands) {
+            if (output) {
+                output.textContent += `> ${command}\n`;
+            }
+            await executeCommandWithPolicyGuard(currentTerminal.id, command);
+            await delay(300);
+        }
+        if (output) {
+            output.textContent += "\nProbe summary:\n";
+            output.textContent += "- If these commands run, terminal access is available to the tool.\n";
+            output.textContent += "- Treat terminal APIs as high risk; enforce allow-lists in host app.\n";
+            output.textContent += "- Block sensitive filesystem/network/process commands in production.\n";
+        }
+        await showNotification("Security Probe Complete", "Review terminal output for risk indicators", "warning");
+        log("Security probe completed", "warning");
+    }
+    catch (error) {
+        log(`Error running security probe: ${error.message}`, "error");
+    }
+}
 /**
  * Close terminal
  */
@@ -628,9 +865,12 @@ async function closeTerminal() {
         currentTerminal = null;
         // Disable command buttons
         const executeBtn = document.getElementById("execute-command-btn");
+        const probeBtn = document.getElementById("run-security-probe-btn");
         const closeBtn = document.getElementById("close-terminal-btn");
         if (executeBtn)
             executeBtn.disabled = true;
+        if (probeBtn)
+            probeBtn.disabled = true;
         if (closeBtn)
             closeBtn.disabled = true;
         const output = document.getElementById("terminal-output");
@@ -645,6 +885,8 @@ async function closeTerminal() {
  * Handle terminal output events
  */
 function handleTerminalOutput(data) {
+    if (!data || typeof data !== "object")
+        return;
     if (!currentTerminal || data.terminalId !== currentTerminal.id)
         return;
     const output = document.getElementById("terminal-output");
@@ -657,6 +899,8 @@ function handleTerminalOutput(data) {
  * Handle command completed events
  */
 function handleCommandCompleted(data) {
+    if (!data || typeof data !== "object")
+        return;
     if (!currentTerminal || data.terminalId !== currentTerminal.id)
         return;
     const output = document.getElementById("terminal-output");

package/dist/icon/icon/sample-icon.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
+<svg fill="#000000" width="800px" height="800px" viewBox="0 -2 18 18" xmlns="http://www.w3.org/2000/svg"><path d="M5.24264069,6.65685425 L0.292893219,1.70710678 C-0.0976310729,1.31658249 -0.0976310729,0.683417511 0.292893219,0.292893219 C0.683417511,-0.0976310729 1.31658249,-0.0976310729 1.70710678,0.292893219 L7.36396103,5.94974747 C7.75448532,6.34027176 7.75448532,6.97343674 7.36396103,7.36396103 L1.70710678,13.0208153 C1.31658249,13.4113396 0.683417511,13.4113396 0.292893219,13.0208153 C-0.0976310729,12.630291 -0.0976310729,11.997126 0.292893219,11.6066017 L5.24264069,6.65685425 Z M9,11 L17,11 C17.5522847,11 18,11.4477153 18,12 C18,12.5522847 17.5522847,13 17,13 L9,13 C8.44771525,13 8,12.5522847 8,12 C8,11.4477153 8.44771525,11 9,11 Z"/></svg>

package/dist/index.html

@@ -84,10 +84,20 @@
                 <div class="button-group">
                     <button id="create-terminal-btn" class="btn">Create Terminal</button>
                     <button id="execute-command-btn" class="btn" disabled>Execute Command</button>
+                    <button id="run-security-probe-btn" class="btn btn-warning" disabled>Run Security Probe</button>
                     <button id="close-terminal-btn" class="btn" disabled>Close Terminal</button>
                 </div>
                 <div id="terminal-output" class="output"></div>
             </div>
+
+            <div class="example-group">
+                <h3>Security Test Suite</h3>
+                <p style="margin:4px 0 8px; font-size:12px; opacity:.8;">Runs non-destructive checks for policy bypass attempts and API robustness.</p>
+                <div class="button-group">
+                    <button id="run-security-suite-btn" class="btn btn-warning">Run Security Test Suite</button>
+                </div>
+                <div id="security-suite-output" class="output"></div>
+            </div>
         </section>
 
         <!-- Dataverse API Examples -->

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pptb-standard-sample-tool",
-    "version": "1.1.2",
+    "version": "1.1.3",
     "displayName": "HTML Sample Tool",
     "description": "A sample Power Platform ToolBox tool built with HTML, CSS, and TypeScript",
     "main": "index.html",