daemon-sec-lotl

catalog-workspace.test.mjs (4219B)

---

 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 import { loadTs } from './_loadts.mjs';
 import { normalizeTechnique, stableId } from '../scripts/enrich-data.mjs';
 import { LIST_FIELDS as indexFields } from '../scripts/build-index.mjs';
 const { configureCommand, quoteArgument, groupTechniques, contextualCounts, sortTechniques } = await loadTs('src/lib/catalog-workspace.ts');
 const { matches, EMPTY_FILTERS, filtersToSearch, filtersFromSearch } = await loadTs('src/lib/techniques.ts');
 const { LIST_FIELDS, renderRow } = await loadTs('src/lib/render-row.ts');
 const row = (over = {}) => ({ id:'a', toolId:'gtfo:vim', toolName:'vim', source:'GTFOBins', command:'vim', platform:['Linux'], capability:['Execution'], nativeCategory:[], mitre:[], references:[], ...over });
 
 test('context/access/service/environment filters compose and round-trip', () => {
   const t = row({ context:'sudo', requires:['Shell'], services:['SMB'], environment:['Local host'], aliases:['vi'] });
   const f = { ...EMPTY_FILTERS, context:['sudo'], requires:['Shell'], services:['SMB'], environment:['Local host'], query:'vi sudo' };
   assert.equal(matches(t,f),true); assert.deepEqual(filtersFromSearch(filtersToSearch(f)),f);
   assert.equal(matches(t,{ ...f, context:['suid'] }),false);
   assert.equal(matches(t,{ ...f, query:'vi missing' }),false);
 });
 test('facet counts exclude their own facet but retain the other filters', () => {
   const rows = [row({context:'sudo'}),row({id:'b',context:'suid'}),row({id:'c',context:'suid',platform:['Windows']})];
   const counts = contextualCounts(rows,{...EMPTY_FILTERS,platform:['Linux'],context:['sudo']});
   assert.deepEqual(counts.context,{sudo:1,suid:1}); assert.deepEqual(counts.platform,{Linux:1});
 });
 test('grouping retains variants and exact tool matches sort first', () => {
   const rows = [row(),row({id:'b',context:'sudo'}),row({id:'c',toolId:'daemon:aws',toolName:'aws'})];
   assert.equal(groupTechniques(rows).length,2); assert.equal(groupTechniques(rows)[0].length,2);
   assert.equal(sortTechniques(rows,'tool','vim')[0].toolName,'vim');
 });
 test('template variables are quoted as arguments and cannot introduce new lines', () => {
   const tpl = {shell:'posix',command:'tool --host {{host}}',variables:[{key:'host',label:'Host',default:'example.test'}]};
   assert.equal(configureCommand(tpl,{}),"tool --host 'example.test'");
   assert.equal(configureCommand(tpl,{host:"x'; echo bad; '"}),"tool --host 'x'\"'\"'; echo bad; '\"'\"''");
   assert.equal(quoteArgument("a'b",'powershell'),"'a''b'");
   assert.throws(()=>configureCommand(tpl,{host:'x\ncommand'}));
   assert.throws(()=>configureCommand({...tpl,command:'tool {{missing}}'},{}));
 });
 test('list payload retains the fields required by filters and configuration', () => {
   assert.deepEqual(LIST_FIELDS,indexFields);
   for (const key of ['context','requires','services','environment','template','references']) assert.ok(indexFields.includes(key));
 });
 test('row markup keeps navigation links outside interactive buttons', () => {
   const html = renderRow(row());
   for (const button of html.matchAll(/<button\b[^>]*>([\s\S]*?)<\/button>/g)) assert.doesNotMatch(button[1],/<a\b/);
 });
 test('normalization removes unverified macOS tags and category pollution', () => {
   const t = normalizeTechnique(row({platform:['Linux','macOS'],requires:['Exploitation','powershell','PowerShell','Hash'],services:['Enumeration','SMB']}));
   assert.deepEqual(t.platform,['Linux']); assert.deepEqual(t.requires,['PowerShell','NTLM hash']); assert.deepEqual(t.services,['SMB']);
   assert.equal(stableId('tool','command'),stableId('tool','command'));
 });
 test('committed additions and imported examples carry explicit evidence', () => {
   const rows = JSON.parse(readFileSync('src/data/techniques.json'));
   const mac = rows.filter(t=>t.source==='LOOBins'); assert.equal(mac.length,183);
   assert.ok(mac.every(t=>t.verification==='Upstream reference' && t.references.some(r=>r.includes('/blob/'))));
   assert.ok(!rows.some(t=>t.source==='GTFOBins' && t.platform.includes('macOS')));
   assert.equal(JSON.parse(readFileSync('src/data/sources/wadcoms-additions.json')).length,134);
 });