* feat(mcp): add workspace root validation to prevent path traversal - Add workspaceRoot field to Service for restricting file operations - Add WithWorkspaceRoot() option for configuring the workspace directory - Add validatePath() helper to check paths are within workspace - Apply validation to all file operation handlers - Default to current working directory for security - Add comprehensive tests for path validation Closes #82 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: move CLI commands from pkg/ to internal/cmd/ - Move 18 CLI command packages to internal/cmd/ (not externally importable) - Keep 16 library packages in pkg/ (externally importable) - Update all import paths throughout codebase - Cleaner separation between CLI logic and reusable libraries CLI commands moved: ai, ci, dev, docs, doctor, gitcmd, go, monitor, php, pkgcmd, qa, sdk, security, setup, test, updater, vm, workspace Libraries remaining: agentic, build, cache, cli, container, devops, errors, framework, git, i18n, io, log, mcp, process, release, repos Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor(mcp): use pkg/io Medium for sandboxed file operations Replace manual path validation with pkg/io.Medium for all file operations. This delegates security (path traversal, symlink bypass) to the sandboxed local.Medium implementation. Changes: - Add io.NewSandboxed() for creating sandboxed Medium instances - Refactor MCP Service to use io.Medium instead of direct os.* calls - Remove validatePath and resolvePathWithSymlinks functions - Update tests to verify Medium-based behaviour Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: correct import path and workflow references - Fix pkg/io/io.go import from core-gui to core - Update CI workflows to use internal/cmd/updater path Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(security): address CodeRabbit review issues for path validation - pkg/io/local: add symlink resolution and boundary-aware containment - Reject absolute paths in sandboxed Medium - Use filepath.EvalSymlinks to prevent symlink bypass attacks - Fix prefix check to prevent /tmp/root matching /tmp/root2 - pkg/mcp: fix resolvePath to validate and return errors - Changed resolvePath from (string) to (string, error) - Update deleteFile, renameFile, listDirectory, fileExists to handle errors - Changed New() to return (*Service, error) instead of *Service - Properly propagate option errors instead of silently discarding - pkg/io: wrap errors with E() helper for consistent context - Copy() and MockMedium.Read() now use coreerr.E() - tests: rename to use _Good/_Bad/_Ugly suffixes per coding guidelines - Fix hardcoded /tmp in TestPath to use t.TempDir() - Add TestResolvePath_Bad_SymlinkTraversal test Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style: fix gofmt formatting Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style: fix gofmt formatting across all files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
145 lines
3.4 KiB
Go
145 lines
3.4 KiB
Go
package testcmd
|
|
|
|
import (
|
|
"bufio"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"os/exec"
|
|
"runtime"
|
|
"strings"
|
|
|
|
"github.com/host-uk/core/pkg/i18n"
|
|
)
|
|
|
|
func runTest(verbose, coverage, short bool, pkg, run string, race, jsonOutput bool) error {
|
|
// Detect if we're in a Go project
|
|
if _, err := os.Stat("go.mod"); os.IsNotExist(err) {
|
|
return errors.New(i18n.T("cmd.test.error.no_go_mod"))
|
|
}
|
|
|
|
// Build command arguments
|
|
args := []string{"test"}
|
|
|
|
// Default to ./... if no package specified
|
|
if pkg == "" {
|
|
pkg = "./..."
|
|
}
|
|
|
|
// Add flags
|
|
if verbose {
|
|
args = append(args, "-v")
|
|
}
|
|
if short {
|
|
args = append(args, "-short")
|
|
}
|
|
if run != "" {
|
|
args = append(args, "-run", run)
|
|
}
|
|
if race {
|
|
args = append(args, "-race")
|
|
}
|
|
|
|
// Always add coverage
|
|
args = append(args, "-cover")
|
|
|
|
// Add package pattern
|
|
args = append(args, pkg)
|
|
|
|
// Create command
|
|
cmd := exec.Command("go", args...)
|
|
cmd.Dir, _ = os.Getwd()
|
|
|
|
// Set environment to suppress macOS linker warnings
|
|
cmd.Env = append(os.Environ(), getMacOSDeploymentTarget())
|
|
|
|
if !jsonOutput {
|
|
fmt.Printf("%s %s\n", testHeaderStyle.Render(i18n.Label("test")), i18n.ProgressSubject("run", "tests"))
|
|
fmt.Printf(" %s %s\n", i18n.Label("package"), testDimStyle.Render(pkg))
|
|
if run != "" {
|
|
fmt.Printf(" %s %s\n", i18n.Label("filter"), testDimStyle.Render(run))
|
|
}
|
|
fmt.Println()
|
|
}
|
|
|
|
// Capture output for parsing
|
|
var stdout, stderr strings.Builder
|
|
|
|
if verbose && !jsonOutput {
|
|
// Stream output in verbose mode, but also capture for parsing
|
|
cmd.Stdout = io.MultiWriter(os.Stdout, &stdout)
|
|
cmd.Stderr = io.MultiWriter(os.Stderr, &stderr)
|
|
} else {
|
|
// Capture output for parsing
|
|
cmd.Stdout = &stdout
|
|
cmd.Stderr = &stderr
|
|
}
|
|
|
|
err := cmd.Run()
|
|
exitCode := 0
|
|
if err != nil {
|
|
if exitErr, ok := err.(*exec.ExitError); ok {
|
|
exitCode = exitErr.ExitCode()
|
|
}
|
|
}
|
|
|
|
// Combine stdout and stderr for parsing, filtering linker warnings
|
|
combined := filterLinkerWarnings(stdout.String() + "\n" + stderr.String())
|
|
|
|
// Parse results
|
|
results := parseTestOutput(combined)
|
|
|
|
if jsonOutput {
|
|
// JSON output for CI/agents
|
|
printJSONResults(results, exitCode)
|
|
if exitCode != 0 {
|
|
return errors.New(i18n.T("i18n.fail.run", "tests"))
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Print summary
|
|
if !verbose {
|
|
printTestSummary(results, coverage)
|
|
} else if coverage {
|
|
// In verbose mode, still show coverage summary at end
|
|
fmt.Println()
|
|
printCoverageSummary(results)
|
|
}
|
|
|
|
if exitCode != 0 {
|
|
fmt.Printf("\n%s %s\n", testFailStyle.Render(i18n.T("cli.fail")), i18n.T("cmd.test.tests_failed"))
|
|
return errors.New(i18n.T("i18n.fail.run", "tests"))
|
|
}
|
|
|
|
fmt.Printf("\n%s %s\n", testPassStyle.Render(i18n.T("cli.pass")), i18n.T("common.result.all_passed"))
|
|
return nil
|
|
}
|
|
|
|
func getMacOSDeploymentTarget() string {
|
|
if runtime.GOOS == "darwin" {
|
|
// Use deployment target matching current macOS to suppress linker warnings
|
|
return "MACOSX_DEPLOYMENT_TARGET=26.0"
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func filterLinkerWarnings(output string) string {
|
|
// Filter out ld: warning lines that pollute the output
|
|
var filtered []string
|
|
scanner := bufio.NewScanner(strings.NewReader(output))
|
|
for scanner.Scan() {
|
|
line := scanner.Text()
|
|
// Skip linker warnings
|
|
if strings.HasPrefix(line, "ld: warning:") {
|
|
continue
|
|
}
|
|
// Skip test binary build comments
|
|
if strings.HasPrefix(line, "# ") && strings.HasSuffix(line, ".test") {
|
|
continue
|
|
}
|
|
filtered = append(filtered, line)
|
|
}
|
|
return strings.Join(filtered, "\n")
|
|
}
|