whale-code 6.5.6 → 6.5.7

package/dist/server/lib/__tests__/code-worker-sandbox-ops.test.js

@@ -0,0 +1,123 @@
+import { describe, it, expect } from "vitest";
+import { runInNewContext } from "node:vm";
+
+/**
+ * Tests for code-worker sandbox operations — deep copy, process isolation, array/string ops
+ * (Split from code-worker.test.ts)
+ */
+
+// ---------------------------------------------------------------------------
+// Re-create the validation + sandbox execution logic for testing
+// ---------------------------------------------------------------------------
+
+const dangerousPatterns = [/constructor\s*\[/i, /constructor\s*\(/i, /\.constructor/i, /__proto__/i, /prototype\s*\[/i, /\bprocess\b/, /\brequire\b/, /\bimport\b/, /\bglobalThis\b/, /\bglobal\b/, /\bFunction\b/, /\beval\b/, /\bReflect\b/, /\bProxy\b/, /\bSymbol\b/, /\bWeakRef\b/];
+function checkDangerousPatterns(code) {
+  for (const pattern of dangerousPatterns) {
+    if (pattern.test(code)) return `Code contains blocked pattern: ${pattern.source}`;
+  }
+  return null;
+}
+function executeInSandbox(code, context, timeoutMs = 5000) {
+  const patternError = checkDangerousPatterns(code);
+  if (patternError) return {
+    success: false,
+    error: patternError
+  };
+  const logs = [];
+  const sandbox = Object.create(null);
+  sandbox.steps = JSON.parse(JSON.stringify(context.steps));
+  sandbox.trigger = JSON.parse(JSON.stringify(context.trigger));
+  sandbox.input = context.input != null ? JSON.parse(JSON.stringify(context.input)) : undefined;
+  sandbox.output = undefined;
+  const consoleObj = Object.create(null);
+  consoleObj.log = (...args) => logs.push(args.map(String).join(" "));
+  sandbox.console = Object.freeze(consoleObj);
+  const jsonNs = Object.create(null);
+  jsonNs.parse = JSON.parse;
+  jsonNs.stringify = JSON.stringify;
+  sandbox.JSON = Object.freeze(jsonNs);
+  sandbox.Math = Math;
+  sandbox.parseInt = parseInt;
+  sandbox.parseFloat = parseFloat;
+  sandbox.isNaN = isNaN;
+  sandbox.isFinite = isFinite;
+  sandbox.process = undefined;
+  sandbox.require = undefined;
+  sandbox.global = undefined;
+  sandbox.globalThis = undefined;
+  sandbox.Function = undefined;
+  sandbox.eval = undefined;
+  sandbox.setTimeout = undefined;
+  sandbox.setInterval = undefined;
+  sandbox.Reflect = undefined;
+  sandbox.Proxy = undefined;
+  try {
+    const result = runInNewContext(code, sandbox, {
+      timeout: timeoutMs,
+      filename: "test-code-step"
+    });
+    return {
+      success: true,
+      output: {
+        result: sandbox.output ?? result,
+        logs
+      },
+      logs
+    };
+  } catch (err) {
+    if (err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT") {
+      return {
+        success: false,
+        error: "Execution timed out"
+      };
+    }
+    return {
+      success: false,
+      error: err.message || String(err)
+    };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("code-worker sandbox — advanced operations", () => {
+  it("context is deep-copied (modifications don't affect originals)", () => {
+    const steps = {
+      data: {
+        count: 5
+      }
+    };
+    const result = executeInSandbox("steps.data.count = 999; output = steps.data.count", {
+      steps,
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(steps.data.count).toBe(5);
+  });
+  it("process is undefined in sandbox", () => {
+    const result = executeInSandbox("output = typeof setTimeout", {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe("undefined");
+  });
+  it("handles array operations in sandbox", () => {
+    const result = executeInSandbox('var arr = [1, 2, 3, 4, 5]; output = arr.filter(function(x) { return x > 3; }).length', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(2);
+  });
+  it("handles string operations in sandbox", () => {
+    const result = executeInSandbox('var s = "Hello World"; output = s.split(" ").length', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(2);
+  });
+});

package/dist/server/lib/__tests__/code-worker-sandbox.test.js

@@ -0,0 +1,217 @@
+import { describe, it, expect } from "vitest";
+import { runInNewContext } from "node:vm";
+
+// ---------------------------------------------------------------------------
+// Re-create the validation logic from code-worker.ts for testing
+// ---------------------------------------------------------------------------
+
+const dangerousPatterns = [/constructor\s*\[/i, /constructor\s*\(/i, /\.constructor/i, /__proto__/i, /prototype\s*\[/i, /\bprocess\b/, /\brequire\b/, /\bimport\b/, /\bglobalThis\b/, /\bglobal\b/, /\bFunction\b/, /\beval\b/, /\bReflect\b/, /\bProxy\b/, /\bSymbol\b/, /\bWeakRef\b/];
+function checkDangerousPatterns(code) {
+  for (const pattern of dangerousPatterns) {
+    if (pattern.test(code)) {
+      return `Code contains blocked pattern: ${pattern.source}`;
+    }
+  }
+  return null;
+}
+function executeInSandbox(code, context, timeoutMs = 5000) {
+  const patternError = checkDangerousPatterns(code);
+  if (patternError) {
+    return {
+      success: false,
+      error: patternError
+    };
+  }
+  const logs = [];
+  const sandbox = Object.create(null);
+  sandbox.steps = JSON.parse(JSON.stringify(context.steps));
+  sandbox.trigger = JSON.parse(JSON.stringify(context.trigger));
+  sandbox.input = context.input != null ? JSON.parse(JSON.stringify(context.input)) : undefined;
+  sandbox.output = undefined;
+  const consoleObj = Object.create(null);
+  consoleObj.log = (...args) => logs.push(args.map(String).join(" "));
+  sandbox.console = Object.freeze(consoleObj);
+  const jsonNs = Object.create(null);
+  jsonNs.parse = JSON.parse;
+  jsonNs.stringify = JSON.stringify;
+  sandbox.JSON = Object.freeze(jsonNs);
+  sandbox.Math = Math;
+  sandbox.parseInt = parseInt;
+  sandbox.parseFloat = parseFloat;
+  sandbox.isNaN = isNaN;
+  sandbox.isFinite = isFinite;
+  sandbox.process = undefined;
+  sandbox.require = undefined;
+  sandbox.global = undefined;
+  sandbox.globalThis = undefined;
+  sandbox.Function = undefined;
+  sandbox.eval = undefined;
+  sandbox.setTimeout = undefined;
+  sandbox.setInterval = undefined;
+  sandbox.Reflect = undefined;
+  sandbox.Proxy = undefined;
+  try {
+    const result = runInNewContext(code, sandbox, {
+      timeout: timeoutMs,
+      filename: "test-code-step"
+    });
+    return {
+      success: true,
+      output: {
+        result: sandbox.output ?? result,
+        logs
+      },
+      logs
+    };
+  } catch (err) {
+    return {
+      success: false,
+      error: err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" ? `Code execution timed out after ${timeoutMs}ms` : `Code error: ${err.message}`,
+      logs
+    };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// TESTS — sandbox execution
+// ---------------------------------------------------------------------------
+
+describe("code-worker — sandbox execution", () => {
+  it("executes simple arithmetic", () => {
+    const result = executeInSandbox("output = 2 + 3", {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(5);
+  });
+  it("can access steps context", () => {
+    const result = executeInSandbox("output = steps.prev.count * 2", {
+      steps: {
+        prev: {
+          count: 10
+        }
+      },
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(20);
+  });
+  it("can access trigger context", () => {
+    const result = executeInSandbox("output = trigger.event_type", {
+      steps: {},
+      trigger: {
+        event_type: "order_created"
+      }
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe("order_created");
+  });
+  it("can access input context", () => {
+    const result = executeInSandbox("output = input.name", {
+      steps: {},
+      trigger: {},
+      input: {
+        name: "test"
+      }
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe("test");
+  });
+  it("captures console.log output", () => {
+    const result = executeInSandbox('console.log("hello"); console.log("world"); output = 42', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.logs).toEqual(["hello", "world"]);
+  });
+  it("handles JSON.parse and JSON.stringify", () => {
+    const result = executeInSandbox('output = JSON.parse(JSON.stringify({ a: 1, b: "two" }))', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toEqual({
+      a: 1,
+      b: "two"
+    });
+  });
+  it("handles Math operations", () => {
+    const result = executeInSandbox("output = Math.max(1, 5, 3) + Math.min(1, 5, 3)", {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(6);
+  });
+  it("handles parseInt and parseFloat", () => {
+    const result = executeInSandbox('output = parseInt("42") + parseFloat("1.5")', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(43.5);
+  });
+  it("blocks dangerous code via pattern check", () => {
+    const result = executeInSandbox('process.exit(1)', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("blocked pattern");
+  });
+  it("returns error on runtime exception", () => {
+    const result = executeInSandbox("undefinedVar.property", {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("Code error");
+  });
+  it("returns timeout error on infinite loop", () => {
+    const result = executeInSandbox("while(true){}", {
+      steps: {},
+      trigger: {}
+    }, 50);
+    expect(result.success).toBe(false);
+    expect(result.error).toContain("timed out");
+  });
+  it("context is deep-copied (modifications don't affect originals)", () => {
+    const steps = {
+      data: {
+        count: 5
+      }
+    };
+    const result = executeInSandbox("steps.data.count = 999; output = steps.data.count", {
+      steps,
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(steps.data.count).toBe(5);
+  });
+  it("process is undefined in sandbox", () => {
+    const result = executeInSandbox("output = typeof setTimeout", {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe("undefined");
+  });
+  it("handles array operations in sandbox", () => {
+    const result = executeInSandbox('var arr = [1, 2, 3, 4, 5]; output = arr.filter(function(x) { return x > 3; }).length', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(2);
+  });
+  it("handles string operations in sandbox", () => {
+    const result = executeInSandbox('var s = "Hello World"; output = s.split(" ").length', {
+      steps: {},
+      trigger: {}
+    });
+    expect(result.success).toBe(true);
+    expect(result.output.result).toBe(2);
+  });
+});

package/dist/server/lib/__tests__/code-worker.test.js

@@ -0,0 +1,179 @@
+import { describe, it, expect } from "vitest";
+
+/**
+ * code-worker.ts runs as a child process (process.send exists).
+ * It guards code with pattern checks and executes in vm.runInNewContext.
+ *
+ * Strategy: We test the exported pure functions (safeFunction, safeNamespace)
+ * via their effects, and the main logic by simulating the IPC message handler.
+ * Since the worker guards on `if (process.send)`, we test by importing
+ * the module functions indirectly through vm-based execution simulation.
+ *
+ * For the pattern checks and sandbox, we test the logic directly by
+ * re-implementing the validation patterns (since the worker module wraps
+ * everything in an `if (process.send)` guard that won't execute in test).
+ */
+
+import { runInNewContext } from "node:vm";
+
+// ---------------------------------------------------------------------------
+// Re-create the validation logic from code-worker.ts for testing
+// ---------------------------------------------------------------------------
+
+const dangerousPatterns = [/constructor\s*\[/i, /constructor\s*\(/i, /\.constructor/i, /__proto__/i, /prototype\s*\[/i, /\bprocess\b/, /\brequire\b/, /\bimport\b/, /\bglobalThis\b/, /\bglobal\b/, /\bFunction\b/, /\beval\b/, /\bReflect\b/, /\bProxy\b/, /\bSymbol\b/, /\bWeakRef\b/];
+function checkDangerousPatterns(code) {
+  for (const pattern of dangerousPatterns) {
+    if (pattern.test(code)) {
+      return `Code contains blocked pattern: ${pattern.source}`;
+    }
+  }
+  return null;
+}
+
+/**
+ * Simulate what the worker does: build sandbox, run code, return result.
+ * Stripped-down version of the code-worker logic for testing.
+ */
+function executeInSandbox(code, context, timeoutMs = 5000) {
+  // Pattern check
+  const patternError = checkDangerousPatterns(code);
+  if (patternError) {
+    return {
+      success: false,
+      error: patternError
+    };
+  }
+  const logs = [];
+  const sandbox = Object.create(null);
+  sandbox.steps = JSON.parse(JSON.stringify(context.steps));
+  sandbox.trigger = JSON.parse(JSON.stringify(context.trigger));
+  sandbox.input = context.input != null ? JSON.parse(JSON.stringify(context.input)) : undefined;
+  sandbox.output = undefined;
+
+  // console.log
+  const consoleObj = Object.create(null);
+  consoleObj.log = (...args) => logs.push(args.map(String).join(" "));
+  sandbox.console = Object.freeze(consoleObj);
+
+  // JSON
+  const jsonNs = Object.create(null);
+  jsonNs.parse = JSON.parse;
+  jsonNs.stringify = JSON.stringify;
+  sandbox.JSON = Object.freeze(jsonNs);
+
+  // Math
+  sandbox.Math = Math;
+  sandbox.parseInt = parseInt;
+  sandbox.parseFloat = parseFloat;
+  sandbox.isNaN = isNaN;
+  sandbox.isFinite = isFinite;
+
+  // Block dangerous globals
+  sandbox.process = undefined;
+  sandbox.require = undefined;
+  sandbox.global = undefined;
+  sandbox.globalThis = undefined;
+  sandbox.Function = undefined;
+  sandbox.eval = undefined;
+  sandbox.setTimeout = undefined;
+  sandbox.setInterval = undefined;
+  sandbox.Reflect = undefined;
+  sandbox.Proxy = undefined;
+  try {
+    const result = runInNewContext(code, sandbox, {
+      timeout: timeoutMs,
+      filename: "test-code-step"
+    });
+    return {
+      success: true,
+      output: {
+        result: sandbox.output ?? result,
+        logs
+      },
+      logs
+    };
+  } catch (err) {
+    return {
+      success: false,
+      error: err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" ? `Code execution timed out after ${timeoutMs}ms` : `Code error: ${err.message}`,
+      logs
+    };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// TESTS
+// ---------------------------------------------------------------------------
+
+describe("code-worker", () => {
+  // =========================================================================
+  // Dangerous pattern detection
+  // =========================================================================
+
+  describe("dangerous pattern detection", () => {
+    it("blocks process access", () => {
+      const error = checkDangerousPatterns('process.exit(1)');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks require", () => {
+      const error = checkDangerousPatterns('const fs = require("fs")');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks import", () => {
+      const error = checkDangerousPatterns('import { readFile } from "fs"');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks globalThis", () => {
+      const error = checkDangerousPatterns('globalThis.process');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks Function constructor", () => {
+      const error = checkDangerousPatterns('new Function("return process")()');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks eval", () => {
+      const error = checkDangerousPatterns('eval("process.exit()")');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks __proto__", () => {
+      const error = checkDangerousPatterns('obj.__proto__.constructor');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks .constructor access", () => {
+      const error = checkDangerousPatterns('[].constructor.constructor("return process")()');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks Reflect", () => {
+      const error = checkDangerousPatterns('Reflect.apply(fn, null, [])');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks Proxy", () => {
+      const error = checkDangerousPatterns('new Proxy({}, {})');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks Symbol", () => {
+      const error = checkDangerousPatterns('Symbol.iterator');
+      expect(error).toContain("blocked pattern");
+    });
+    it("blocks WeakRef", () => {
+      const error = checkDangerousPatterns('new WeakRef(obj)');
+      expect(error).toContain("blocked pattern");
+    });
+    it("allows safe arithmetic code", () => {
+      const error = checkDangerousPatterns('output = 1 + 2 + 3');
+      expect(error).toBeNull();
+    });
+    it("allows JSON parsing", () => {
+      const error = checkDangerousPatterns('output = JSON.parse(\'{"a":1}\')');
+      expect(error).toBeNull();
+    });
+    it("allows console.log", () => {
+      const error = checkDangerousPatterns('console.log("hello")');
+      expect(error).toBeNull();
+    });
+    it("allows Math operations", () => {
+      const error = checkDangerousPatterns('output = Math.max(1, 2, 3)');
+      expect(error).toBeNull();
+    });
+  });
+});