copilot-swe-agent[bot]
93de5ca4f8
- Fix path traversal in _glob_search by validating resolved paths stay within workspace root - Fix ReDoS vulnerability in _grep_search by adding regex compilation error handling - Replace 6 assert statements with explicit validation (assertions are disabled with -O flag) - Replace bare except Exception with specific exception types (OSError, KeyError, ValueError) - Block file:// scheme in web_fetch to prevent SSRF attacks - Filter sensitive environment variables from subprocess execution - Update test to verify file:// scheme rejection Agent-Logs-Url: https://github.com/HarnessLab/claw-code-agent/sessions/94dfb41f-57dd-48ea-ab0d-d2f2249ef950 Co-authored-by: abdoelsayed2016 <27821589+abdoelsayed2016@users.noreply.github.com>
68 lines
2.3 KiB
Python
68 lines
2.3 KiB
Python
from __future__ import annotations
|
|
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from src.agent_tools import build_tool_context, default_tool_registry, execute_tool
|
|
from src.agent_types import AgentRuntimeConfig
|
|
|
|
|
|
class ExtendedToolTests(unittest.TestCase):
|
|
def test_web_fetch_rejects_file_url(self) -> None:
|
|
"""Verify that file:// URLs are blocked to prevent SSRF attacks."""
|
|
with tempfile.TemporaryDirectory() as tmp_dir:
|
|
workspace = Path(tmp_dir)
|
|
target = workspace / 'page.txt'
|
|
target.write_text('hello from web fetch\n', encoding='utf-8')
|
|
context = build_tool_context(
|
|
AgentRuntimeConfig(cwd=workspace),
|
|
tool_registry=default_tool_registry(),
|
|
)
|
|
result = execute_tool(
|
|
default_tool_registry(),
|
|
'web_fetch',
|
|
{'url': target.resolve().as_uri()},
|
|
context,
|
|
)
|
|
|
|
self.assertFalse(result.ok)
|
|
self.assertIn('http or https', result.content)
|
|
|
|
def test_tool_search_lists_matching_tools(self) -> None:
|
|
registry = default_tool_registry()
|
|
with tempfile.TemporaryDirectory() as tmp_dir:
|
|
context = build_tool_context(
|
|
AgentRuntimeConfig(cwd=Path(tmp_dir)),
|
|
tool_registry=registry,
|
|
)
|
|
result = execute_tool(
|
|
registry,
|
|
'tool_search',
|
|
{'query': 'file'},
|
|
context,
|
|
)
|
|
|
|
self.assertTrue(result.ok)
|
|
self.assertIn('# Tool Search', result.content)
|
|
self.assertIn('read_file', result.content)
|
|
self.assertIn('write_file', result.content)
|
|
|
|
def test_sleep_tool_waits_briefly_and_returns_metadata(self) -> None:
|
|
registry = default_tool_registry()
|
|
with tempfile.TemporaryDirectory() as tmp_dir:
|
|
context = build_tool_context(
|
|
AgentRuntimeConfig(cwd=Path(tmp_dir)),
|
|
tool_registry=registry,
|
|
)
|
|
result = execute_tool(
|
|
registry,
|
|
'sleep',
|
|
{'seconds': 0.01},
|
|
context,
|
|
)
|
|
|
|
self.assertTrue(result.ok)
|
|
self.assertIn('slept for', result.content)
|
|
self.assertEqual(result.metadata.get('action'), 'sleep')
|