tests/test_command_review.py

import importlib.util
from pathlib import Path
import unittest

ROOT=Path(__file__).resolve().parents[1]
spec=importlib.util.spec_from_file_location("command_review",ROOT/"scripts"/"command_review.py")
cr=importlib.util.module_from_spec(spec)
spec.loader.exec_module(cr)

class CommandReviewTests(unittest.TestCase):
    def check(self,command,expected_id,level=None):
        r=cr.analyze(command)
        self.assertIn(expected_id,{x['id'] for x in r['findings']})
        if level:self.assertEqual(r['risk'],level)
        self.assertIs(r['executed'],False)
    def test_read_only(self):
        for command in ['pwd','printf "%s\\n" "$HOME"',"find . -type f -print", "grep -n error logfile"]:
            r=cr.analyze(command)
            self.assertEqual(r['risk'],'unknown');self.assertEqual(len(r['findings']),0)
    def test_recursive_rm(self):self.check('rm -rf "$TARGET"','recursive-delete','high')
    def test_recursive_rm_short_flags(self):self.check('rm -fr ./old','recursive-delete','high')
    def test_recursive_rm_other_flags(self):self.check('rm -vRf /tmp/x','recursive-delete','high')
    def test_variable_rm(self):self.check('rm "$TARGET"','unverified-variable-delete','high')
    def test_curl_pipe_bash(self):self.check('curl https://example.test/install.sh | bash','fetch-execute','high')
    def test_wget_pipe_sh(self):self.check('wget -O - https://example.test/x | sh','fetch-execute','high')
    def test_sudo(self):self.check('sudo systemctl restart sshd','privileged-command','high')
    def test_chmod_777(self):self.check('chmod -R 777 /srv/site','broad-permissions','high')
    def test_chown_recursive(self):self.check('chown -R app:app /srv/site','recursive-owner-change','high')
    def test_disk_dd(self):self.check('dd if=foo.img of=/dev/sdb bs=1M','disk-write','high')
    def test_mkfs(self):self.check('mkfs.ext4 /dev/sdb1','format-device','high')
    def test_kill(self):self.check('kill -9 9999','force-kill','high')
    def test_rsync_delete(self):self.check('rsync -a --delete a/ b/','rsync-delete','high')
    def test_eval(self):self.check('eval "$cmd"','shell-eval','medium')
    def test_cut_csv(self):self.check("cut -d, -f1,3 data.csv",'csv-cut','medium')
    def test_no_execution(self):self.assertFalse(cr.analyze('cat file.txt')['executed'])
    def test_line_number(self):
        r=cr.analyze('pwd\nrm -rf x')
        self.assertEqual(next(x['line'] for x in r['findings'] if x['id']=='recursive-delete'),2)
    def test_case_types(self):
        with self.assertRaises(TypeError):cr.analyze(None)
    def test_static_warning(self):self.assertIn('not full parsing',cr.analyze('pwd')['warning'])
    def test_high_dominates_medium(self):self.assertEqual(cr.analyze('eval "$x"; sudo true')['risk'],'high')
    def test_empty(self):self.assertEqual(cr.analyze('')['risk'],'unknown')

if __name__=='__main__':unittest.main()