fred
15644d81d4
get_gitea_login_for_host() returned the FIRST tea login matching the host. With 43 logins on this host, roughly half match one server, so a seat whose own login was missing silently acted as whichever identity happened to sort first. That satisfies gate 16 mechanically (an author and a reviewer exist) while violating it (both are the same actor under two names). A seat now declares itself via MOSAIC_GIT_IDENTITY or `git config mosaic.gitIdentity`, and resolution derives the canonical login name from that identity plus the instance (`<instance>-<seat>`). If that login is absent it fails closed with a named error and the command to create it. It never borrows. Same rule on the --repo override path, which had it worse: it fell through to get_default_tea_login(), i.e. the default-marked login or, failing that, the first login of ANY host -- an identity chosen by config file order. The four callers now pass the owner so the instance can be derived. With no identity set (a human at a terminal) the old fallback is unchanged, which is the same point at which the token path stops enforcing. lane-brief.sh mapped owners straight to the SHARED `usc` / `mosaicstack` logins. The ladder now goes first there, and a seat that cannot resolve its own login exits rather than falling through to a shared one. Also adds tools/fleet/seat-logins.sh: projects seat credentials into tea logins under canonical names, so the name this code requires is one an operator can mechanically produce rather than hand-maintain. Test notes: - The suite had TWO sandbox helpers, run_in_repo and a near-copy run_in_repo2. The copy drifted: it never got the identity unset, so the suite kept failing on a provisioned seat after the original was already fixed. run_in_repo2 now delegates, so the guarantee lives in one place. - New coverage for both ladder branches (login present -> used; absent -> named error and NOTHING on stdout, proving it did not borrow the matching login sitting right there), both identity rungs, the --repo path, and explicit GITEA_LOGIN outranking the ladder. Each verified by injecting the regression it claims to catch and confirming it goes red. - test-issue-create-body-safety.sh now pins the no-identity case; its subject is body quoting, and an ambient seat identity made it fail for an unrelated reason. - test-issue-close-fail-closed.sh derives its fixture login from the runner's identity. This does not make it hermetic and does not claim to: its API-path cases need a real credential for the runner's own identity, so it passes only where the runner owns one, on this branch and on its base alike. Pre-existing, documented in the PR rather than papered over.
114 lines
3.6 KiB
Bash
Executable File
114 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Regression harness for issue-create.sh Markdown-body safety (#559).
|
|
#
|
|
# Guards against reintroduction of eval-based command construction. The wrapper
|
|
# builds its tea/gh invocation as an argv array, so a body containing command
|
|
# substitution ($(...)), backticks, quotes, and dollar signs MUST reach tea
|
|
# verbatim and MUST NOT be shell-evaluated. This test asserts both:
|
|
# 1. No command-substitution side effect (an injected `touch SENTINEL` never runs).
|
|
# 2. The --description value tea receives is byte-for-byte the original body.
|
|
|
|
set -euo pipefail
|
|
|
|
# HERMETICITY (#1356): this suite's subject is body quoting, not identity. An
|
|
# ambient MOSAIC_GIT_IDENTITY (every provisioned seat exports one) would make the
|
|
# identity ladder demand a per-seat login this fixture does not define, and the
|
|
# suite would fail for a reason it is not testing.
|
|
unset MOSAIC_GIT_IDENTITY
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/issue-create-body-safety}"
|
|
REPO_DIR="$WORK_DIR/repo"
|
|
BIN_DIR="$WORK_DIR/bin"
|
|
SENTINEL="$WORK_DIR/INJECTION_SENTINEL"
|
|
BODY_FILE="$WORK_DIR/body.txt"
|
|
RECEIVED_FILE="$WORK_DIR/received-description.txt"
|
|
|
|
rm -rf "$WORK_DIR"
|
|
mkdir -p "$REPO_DIR" "$BIN_DIR"
|
|
|
|
git -C "$REPO_DIR" init -q
|
|
git -C "$REPO_DIR" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
|
|
|
|
# Hostile Markdown body. The unquoted heredoc expands $SENTINEL (a real path we
|
|
# want embedded) but every shell metacharacter we care about is backslash-escaped
|
|
# so the TEST shell writes them literally into the file — the bytes the wrapper
|
|
# must then preserve.
|
|
cat > "$BODY_FILE" <<EOF
|
|
# Release notes
|
|
|
|
Inline code: \`rm -rf /\` must stay literal.
|
|
Command sub attempt: \$(touch $SENTINEL)
|
|
Backtick cmd attempt: \`touch $SENTINEL\`
|
|
Dollars: \$HOME \${PATH} \$5.00 and 100% done
|
|
Quotes: "double" and 'single' and \`mixed\`
|
|
Trailing pipe-ish: foo | bar && baz ; qux
|
|
EOF
|
|
|
|
BODY="$(cat "$BODY_FILE")"
|
|
|
|
# Mock tea: resolve a mosaicstack login, then capture the --description verbatim.
|
|
cat > "$BIN_DIR/tea" <<'SH'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ "$*" == "login list --output json" ]]; then
|
|
cat <<'JSON'
|
|
[
|
|
{"name":"mosaicstack","url":"https://git.mosaicstack.dev","user":"ci-bot"}
|
|
]
|
|
JSON
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "${1:-}" == "api" ]]; then
|
|
printf '%s\n' '{"login":"ci-bot"}'
|
|
exit 0
|
|
fi
|
|
|
|
if [[ "${1:-}" == "issue" && "${2:-}" == "create" ]]; then
|
|
desc=""
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--description) desc="$2"; shift 2 ;;
|
|
*) shift ;;
|
|
esac
|
|
done
|
|
printf '%s' "$desc" > "$MOSAIC_TEST_RECEIVED"
|
|
echo "#1 created"
|
|
exit 0
|
|
fi
|
|
|
|
exit 0
|
|
SH
|
|
chmod +x "$BIN_DIR/tea"
|
|
|
|
(
|
|
cd "$REPO_DIR"
|
|
PATH="$BIN_DIR:$PATH" \
|
|
MOSAIC_TEST_RECEIVED="$RECEIVED_FILE" \
|
|
"$SCRIPT_DIR/issue-create.sh" -t "Body safety test" -b "$BODY"
|
|
) >/dev/null
|
|
|
|
# 1. No command substitution executed anywhere in the pipeline.
|
|
if [[ -e "$SENTINEL" ]]; then
|
|
echo "FAIL: injected command substitution executed (sentinel file created): $SENTINEL" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# 2. tea actually received the body (issue create path taken, not silently dropped).
|
|
if [[ ! -f "$RECEIVED_FILE" ]]; then
|
|
echo "FAIL: tea issue create was never invoked with a --description" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# 3. The description tea received is byte-for-byte the original body.
|
|
if [[ "$(cat "$RECEIVED_FILE")" != "$BODY" ]]; then
|
|
echo "FAIL: body was not preserved verbatim through issue-create.sh" >&2
|
|
echo "--- expected ---" >&2; printf '%s\n' "$BODY" >&2
|
|
echo "--- received ---" >&2; cat "$RECEIVED_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "issue-create.sh Markdown body-safety regression harness passed"
|