wanctl/security_scan_test.go at main · Daily-AC/wanctl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
package main

import (
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

func TestImageScanForwardsProxyEnvironmentToTrivy(t *testing.T) {
	temp := t.TempDir()
	binDir := filepath.Join(temp, "bin")
	artifactsDir := filepath.Join(temp, "artifacts")
	logPath := filepath.Join(temp, "docker.log")
	if err := os.MkdirAll(binDir, 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(artifactsDir, 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(artifactsDir, "wanctl-image.tar"), nil, 0o644); err != nil {
		t.Fatal(err)
	}
	fakeDocker := `#!/bin/sh
printf 'ARGS %s\n' "$*" >>"$DOCKER_LOG"
printf 'ENV HTTP_PROXY=%s HTTPS_PROXY=%s http_proxy=%s https_proxy=%s\n' \
  "$HTTP_PROXY" "$HTTPS_PROXY" "$http_proxy" "$https_proxy" >>"$DOCKER_LOG"
`
	if err := os.WriteFile(filepath.Join(binDir, "docker"), []byte(fakeDocker), 0o755); err != nil {
		t.Fatal(err)
	}

	cmd := exec.Command("sh", "scripts/security-scan.sh", "image")
	cmd.Env = append(os.Environ(),
		"PATH="+binDir+":"+os.Getenv("PATH"),
		"DOCKER_LOG="+logPath,
		"WANCTL_ARTIFACTS_DIR="+artifactsDir,
		"HTTP_PROXY=http://127.0.0.1:7890",
		"HTTPS_PROXY=http://127.0.0.1:7890",
		"NO_PROXY=localhost",
		"http_proxy=http://127.0.0.1:7890",
		"https_proxy=http://127.0.0.1:7890",
		"no_proxy=localhost",
	)
	if output, err := cmd.CombinedOutput(); err != nil {
		t.Fatalf("security scan failed: %v\n%s", err, output)
	}
	log, err := os.ReadFile(logPath)
	if err != nil {
		t.Fatal(err)
	}
	args := string(log)
	if !strings.Contains(args, "--network host") {
		t.Errorf("docker run does not share the host network for a loopback proxy: %s", args)
	}
	for _, name := range []string{"HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy"} {
		if !strings.Contains(args, "-e "+name) {
			t.Errorf("docker run does not inherit %s: %s", name, args)
		}
	}
	for _, line := range strings.Split(args, "\n") {
		if strings.HasPrefix(line, "ARGS ") && strings.Contains(line, "127.0.0.1:7890") {
			t.Fatalf("proxy values leaked into docker arguments: %s", args)
		}
	}
	for _, want := range []string{
		"HTTP_PROXY=http://127.0.0.1:7890",
		"HTTPS_PROXY=http://127.0.0.1:7890",
		"http_proxy=http://127.0.0.1:7890",
		"https_proxy=http://127.0.0.1:7890",
	} {
		if !strings.Contains(args, want) {
			t.Errorf("container did not inherit the loopback proxy, want %q in %s", want, args)
		}
	}
}