test: add experimental UT around probes (NodeSecure#29)

* wip

* is unsafe callee

* assert eval

* update

* chore: example test

* fix review comments

* chore: use symbol.for

* tests: add tests cases

.eslintignore

@@ -1,3 +1,4 @@
 test/fixtures
 cases/
 temp.js
+test/probes/fixtures/**/*.js

.gitignore

@@ -105,3 +105,4 @@ dist
 
 temp.js
 temp/
+.vscode/

package.json

@@ -10,7 +10,7 @@
   "scripts": {
     "lint": "eslint src test",
     "prepublishOnly": "pkg-ok",
-    "test": "cross-env esm-tape-runner 'test/*.spec.js' | tap-monkey",
+    "test": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
     "check": "cross-env npm run lint && npm run test"
   },
   "repository": {

test/probes/fixtures/unsafeCallee/1-unsafeCallee.js

@@ -0,0 +1 @@
+eval("this");

test/probes/fixtures/unsafeCallee/2-unsafeCallee.js

@@ -0,0 +1 @@
+Function("return this")()

test/probes/fixtures/unsafeCallee/3-unsafeCallee.js

@@ -0,0 +1 @@
+Function('foo');

test/probes/isUnsafeCallee.spec.js

@@ -0,0 +1,52 @@
+// Require Internal Dependencies
+import { parseScript, getSastAnalysis, getWarningOnAnalysisResult } from "../utils/index.js";
+import { warnings } from "../../index.js";
+import isUnsafeCallee from "../../src/probes/isUnsafeCallee.js";
+
+// Require Third-party dependencies
+import test from "tape";
+
+// Require Node.js Dependencies
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { readFileSync } from "fs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_PATH = join(__dirname, "fixtures/unsafeCallee");
+
+const warningUnsafeStmt = warnings.unsafeStmt.code;
+
+test("should detect eval", (tape) => {
+  const str = readFileSync(join(FIXTURE_PATH, "1-unsafeCallee.js"), "utf-8");
+
+  const ast = parseScript(str);
+  const analysis = getSastAnalysis(str, ast.body, isUnsafeCallee);
+
+  const result = getWarningOnAnalysisResult(analysis, warningUnsafeStmt);
+  tape.equal(result.kind, warningUnsafeStmt);
+  tape.equal(result.value, "eval");
+  tape.end();
+});
+
+test("should detect Function", (tape) => {
+  const str = readFileSync(join(FIXTURE_PATH, "2-unsafeCallee.js"), "utf-8");
+
+  const ast = parseScript(str);
+  const analysis = getSastAnalysis(str, ast.body, isUnsafeCallee);
+
+  const result = getWarningOnAnalysisResult(analysis, warningUnsafeStmt);
+  tape.equal(result.kind, warningUnsafeStmt);
+  tape.equal(result.value, "Function");
+  tape.end();
+});
+
+test("should not detect Function", (tape) => {
+  const str = readFileSync(join(FIXTURE_PATH, "3-unsafeCallee.js"), "utf-8");
+
+  const ast = parseScript(str);
+  const analysis = getSastAnalysis(str, ast.body, isUnsafeCallee);
+
+  const result = getWarningOnAnalysisResult(analysis, warningUnsafeStmt);
+  tape.equal(result, undefined);
+  tape.end();
+});

test/utils/index.js

@@ -1,3 +1,58 @@
+import * as meriyah from "meriyah";
+import Analysis from "../../src/Analysis.js";
+import { walk } from "estree-walker";
+
 export function getWarningKind(warnings) {
   return warnings.slice().map((warn) => warn.kind).sort();
 }
+
+export function parseScript(str) {
+  return meriyah.parseScript(str, {
+    next: true,
+    loc: true,
+    raw: true,
+    module: true,
+    globalReturn: false
+  });
+}
+
+function runOnProbes(node, analysis, probe) {
+  const [isMatching, data = null] = probe.validateNode(node, analysis);
+
+  if (isMatching) {
+    const result = probe.main(node, { analysis, data });
+
+    if (result === Symbol.for("skipWalk")) {
+      return "skip";
+    }
+  }
+
+  return null;
+}
+
+export function getSastAnalysis(strSource, body, probe) {
+  const sastAnalysis = new Analysis();
+  sastAnalysis.analyzeSourceString(strSource);
+
+  walk(body, {
+    enter(node) {
+      // Skip the root of the AST.
+      if (Array.isArray(node)) {
+        return;
+      }
+
+
+      const action = runOnProbes(node, sastAnalysis, probe);
+
+      if (action === "skip") {
+        this.skip();
+      }
+    }
+  });
+
+  return sastAnalysis;
+}
+
+export function getWarningOnAnalysisResult(analysis, warning) {
+  return analysis.warnings.find((item) => item.kind === warning);
+}