luajitos

test_sandbox.lua (6043B)

---

 -- Test file for OrbitManager.newSandbox
 
 local OrbitManager = require("OrbitManager")
 
 print("=== OrbitManager.newSandbox Test Suite ===\n")
 
 -- Test manifest
 local manifestString = [[
 return {
     name = "sandboxedapp";
     dev = "testdev";
     perms = {
         fs = true,
         os = false,
         network = false
     };
     allowedPaths = {
         "/tmp/*",
         "/home/user/data/*"
     };
     allowedDomains = {
         "api.example.com"
     }
 }
 ]]
 
 -- Test 1: Create a sandbox
 print("1. Creating sandbox with OrbitManager.newSandbox...")
 local orbit, sandbox = OrbitManager.newSandbox(manifestString)
 print("   ✓ Sandbox created successfully\n")
 
 -- Test 2: Check that safe functions are available
 print("2. Testing safe functions in sandbox...")
 print("   print available:", type(sandbox.print))
 print("   string.upper available:", type(sandbox.string.upper))
 print("   math.sin available:", type(sandbox.math.sin))
 print("   table.insert available:", type(sandbox.table.insert))
 print("   ✓ Safe functions are accessible\n")
 
 -- Test 3: Check that dangerous functions are blocked
 print("3. Testing that dangerous functions are blocked...")
 print("   debug library:", type(sandbox.debug))
 print("   loadfile:", type(sandbox.loadfile))
 print("   dofile:", type(sandbox.dofile))
 print("   ✓ Dangerous functions are nil (blocked)\n")
 
 -- Test 4: Check that permission-controlled functions exist but are stubbed
 print("4. Testing permission-controlled functions...")
 print("   io.open available:", type(sandbox.io.open))
 print("   os.execute available:", type(sandbox.os.execute))
 print("   os.clock available:", type(sandbox.os.clock))
 print()
 
 -- Test 5: Try to use io.open with permissions granted
 print("5. Testing io.open with fs permissions (should work for allowed paths)...")
 local success, err = pcall(function()
     -- This should work because perms.fs = true and /tmp/* is allowed
     sandbox.io.open("/tmp/test.txt", "r")
 end)
 if success then
     print("   ✓ io.open('/tmp/test.txt') succeeded")
 else
     print("   ✗ io.open failed:", err)
 end
 
 success, err = pcall(function()
     -- This should fail because /etc/passwd is not in allowedPaths
     sandbox.io.open("/etc/passwd", "r")
 end)
 if not success then
     print("   ✓ io.open('/etc/passwd') blocked:", err)
 else
     print("   ✗ FAILED: Should have blocked /etc/passwd")
 end
 print()
 
 -- Test 6: Try to use os.execute without permissions
 print("6. Testing os.execute without os permissions (should fail)...")
 success, err = pcall(function()
     sandbox.os.execute("ls")
 end)
 if not success then
     print("   ✓ os.execute blocked:", err)
 else
     print("   ✗ FAILED: Should have blocked os.execute")
 end
 print()
 
 -- Test 7: Test safe string operations in sandbox
 print("7. Testing safe operations in sandbox...")
 local testCode = [[
     local str = "hello world"
     local upper = string.upper(str)
     local result = string.sub(upper, 1, 5)
     return result
 ]]
 
 local chunk, compileErr = load(testCode, "testCode", "t", sandbox)
 if chunk then
     local ok, result = pcall(chunk)
     if ok then
         print("   ✓ Sandbox code executed successfully, result:", result)
     else
         print("   ✗ Sandbox code failed:", result)
     end
 else
     print("   ✗ Failed to compile:", compileErr)
 end
 print()
 
 -- Test 8: Test that sandbox cannot access global _G
 print("8. Testing sandbox isolation from global environment...")
 local isolationTest = [[
     -- Try to access something from the real _G (should not be possible)
     -- The sandbox _G should point to itself, not the real global
     return _G == _ENV
 ]]
 
 chunk, compileErr = load(isolationTest, "isolationTest", "t", sandbox)
 if chunk then
     local ok, result = pcall(chunk)
     print("   Sandbox _G == _ENV:", result)
     print("   ✓ Sandbox has its own _G\n")
 end
 
 -- Test 9: Test that blocked functions really don't exist
 print("9. Testing execution of code that tries to use blocked functions...")
 local blockedTest = [[
     if debug then
         return "FAIL: debug should be blocked"
     end
     if loadfile then
         return "FAIL: loadfile should be blocked"
     end
     return "SUCCESS: blocked functions are nil"
 ]]
 
 chunk, compileErr = load(blockedTest, "blockedTest", "t", sandbox)
 if chunk then
     local ok, result = pcall(chunk)
     print("   " .. (result or "error"))
 end
 print()
 
 -- Test 10: Test math and table operations
 print("10. Testing math and table operations in sandbox...")
 local mathTest = [[
     local nums = {1, 5, 3, 9, 2}
     table.sort(nums)
     local sum = 0
     for i = 1, #nums do
         sum = sum + nums[i]
     end
     return sum, math.sqrt(sum)
 ]]
 
 chunk, compileErr = load(mathTest, "mathTest", "t", sandbox)
 if chunk then
     local ok, sum, sqrt = pcall(chunk)
     if ok then
         print("   ✓ Math operations work: sum =", sum, "sqrt =", sqrt)
     else
         print("   ✗ Failed:", sum)
     end
 end
 print()
 
 -- Test 11: Create another sandbox with different permissions
 print("11. Testing second sandbox with OS permissions but no FS...")
 local manifest2 = [[
 return {
     name = "ostool";
     dev = "admin";
     perms = {
         fs = false,
         os = true
     };
     allowedPaths = {};
     allowedDomains = {}
 }
 ]]
 
 local orbit2, sandbox2 = OrbitManager.newSandbox(manifest2)
 print("   Created second sandbox")
 
 success, err = pcall(function()
     sandbox2.os.clock()
 end)
 if success then
     print("   ✓ os.clock works with os permissions")
 else
     print("   ✗ os.clock failed:", err)
 end
 
 success, err = pcall(function()
     sandbox2.io.open("/tmp/test.txt", "r")
 end)
 if not success then
     print("   ✓ io.open blocked without fs permissions:", err)
 else
     print("   ✗ FAILED: Should have blocked io.open")
 end
 print()
 
 -- Test 12: Test getSandbox method
 print("12. Testing getSandbox method...")
 local retrievedSandbox = orbit:getSandbox()
 print("   getSandbox returned:", type(retrievedSandbox))
 print("   Same as original sandbox:", retrievedSandbox == sandbox)
 print()
 
 print("=== All Tests Complete ===")