mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 21:46:49 +00:00
mauriceboe
f7c54d3d90
Plugins placed on the /plugins volume are now discovered, validated and registered
as inactive, ready to activate.
- manifest.ts: strict trek-plugin.json validation (id/version/type, known
permissions only, egress required with http:outbound, native modules rejected).
- discovery.ts: scans the volume on startup + on demand (POST /api/admin/plugins/
rescan), upserts rows INACTIVE, refreshes settings-field descriptors, and never
downgrades or wipes an already-installed plugin's status / grants / config.
Invalid or native-carrying plugins are skipped and logged.
- Activation now grants the DECLARED permissions (the consent gate) and persists
them before spawning.
- install/ utilities for the registry installer (M5), each independently tested:
- safe-fetch: host allowlist (GitHub only) + private-IP refusal + manual
redirect following + size cap + sha256 (constant-time compare).
- safe-extract: zip/tar-slip-safe extraction with its own minimal tar.gz + zip
readers; rejects traversal, absolute paths, symlinks, oversized/too-many
entries, and unsupported formats.
- native-scan: refuses .node / binding.gyp / prebuilds, never follows symlinks.
33 lines
1.5 KiB
TypeScript
33 lines
1.5 KiB
TypeScript
/**
|
|
* Native-binary scan (#plugins, M4): .node / binding.gyp / prebuilds are
|
|
* forbidden; symlinks are never followed.
|
|
*/
|
|
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
|
import fs from 'node:fs';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { scanForNativeBinaries } from '../../../src/nest/plugins/install/native-scan';
|
|
|
|
let dir: string;
|
|
beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nscan-')); });
|
|
afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
|
|
|
|
describe('scanForNativeBinaries', () => {
|
|
it('is clean for a plain JS plugin', () => {
|
|
fs.mkdirSync(path.join(dir, 'server'), { recursive: true });
|
|
fs.writeFileSync(path.join(dir, 'server', 'index.js'), 'module.exports = {}');
|
|
expect(scanForNativeBinaries(dir)).toEqual([]);
|
|
});
|
|
|
|
it('flags .node binaries, binding.gyp and prebuilds/', () => {
|
|
fs.mkdirSync(path.join(dir, 'node_modules', 'sharp', 'prebuilds'), { recursive: true });
|
|
fs.writeFileSync(path.join(dir, 'node_modules', 'sharp', 'sharp.node'), '\0');
|
|
fs.writeFileSync(path.join(dir, 'node_modules', 'sharp', 'binding.gyp'), '{}');
|
|
fs.writeFileSync(path.join(dir, 'node_modules', 'sharp', 'prebuilds', 'x.txt'), 'x');
|
|
const hits = scanForNativeBinaries(dir);
|
|
expect(hits.some((h) => h.endsWith('sharp.node'))).toBe(true);
|
|
expect(hits.some((h) => h.endsWith('binding.gyp'))).toBe(true);
|
|
expect(hits.some((h) => h.includes('prebuilds'))).toBe(true);
|
|
});
|
|
});
|