100 lines
4.9 KiB
TypeScript
100 lines
4.9 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import type { EnvironmentObservation } from '../../src/domain/environment-context';
|
|
import {
|
|
discloseSupplementalObservation,
|
|
RESULT_DB_SUPPLEMENTAL_DISCLOSURE_POLICY_VERSION
|
|
} from '../../src/domain/result-db-supplemental-disclosure';
|
|
|
|
function observation(overrides: Partial<EnvironmentObservation> = {}): EnvironmentObservation {
|
|
return {
|
|
version: 1,
|
|
id: 'synthetic-observation',
|
|
scanRunId: 'synthetic-run',
|
|
importFileId: 'synthetic-file',
|
|
tool: { id: 'pingcastle', name: 'PingCastle', version: 'synthetic' },
|
|
subject: { type: 'domain-information', identity: 'private.synthetic.example', label: 'Private Customer' },
|
|
property: 'domain.functional_level',
|
|
label: 'Customer supplied label',
|
|
originalValue: 'Windows Server 2016 for Private Customer',
|
|
normalizedValue: 2016,
|
|
valueType: 'number',
|
|
state: 'observed',
|
|
source: { objectPath: 'html/private/customer/path' },
|
|
mappingVersion: 'synthetic',
|
|
attributes: { customer: 'Private Customer' },
|
|
...overrides
|
|
};
|
|
}
|
|
|
|
describe('Result DB supplemental disclosure boundary', () => {
|
|
it('rebuilds an approved value from controlled metadata without carrying source identity or raw context', () => {
|
|
const disclosed = discloseSupplementalObservation(observation());
|
|
|
|
expect(disclosed).toEqual({
|
|
policyVersion: RESULT_DB_SUPPLEMENTAL_DISCLOSURE_POLICY_VERSION,
|
|
disclosureClass: 'technical-metadata',
|
|
property: 'domain.functional_level',
|
|
title: 'Domain functional level',
|
|
subjectType: 'active-directory-environment',
|
|
value: 2016,
|
|
valueType: 'number',
|
|
state: 'observed'
|
|
});
|
|
expect(JSON.stringify(disclosed)).not.toMatch(/Private Customer|private\.synthetic|customer\/path/i);
|
|
});
|
|
|
|
it('fails closed for identifying, unknown, future-tool and malformed supplemental values', () => {
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'domain.fqdn', normalizedValue: 'private.synthetic.example', valueType: 'string'
|
|
}))).toBeUndefined();
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'future.private.field', normalizedValue: 'Private Customer', valueType: 'string'
|
|
}))).toBeUndefined();
|
|
expect(discloseSupplementalObservation(observation({
|
|
tool: { id: 'future-scanner', name: 'Future Scanner' }
|
|
}))).toBeUndefined();
|
|
expect(discloseSupplementalObservation(observation({
|
|
normalizedValue: '2016.private.synthetic.example', valueType: 'string'
|
|
}))).toBeUndefined();
|
|
});
|
|
|
|
it('allows bounded aggregate and boolean configuration values only', () => {
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'risk.domain', normalizedValue: 42, originalValue: 'Private score 42'
|
|
}))).toMatchObject({ value: 42, disclosureClass: 'aggregate' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'domain.recycle_bin_enabled', normalizedValue: true, originalValue: 'Private enabled', valueType: 'boolean'
|
|
}))).toMatchObject({ value: true, disclosureClass: 'configuration-state' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'risk.domain', normalizedValue: 101
|
|
}))).toBeUndefined();
|
|
});
|
|
|
|
it('discloses non-identifying environment aggregates and configuration state', () => {
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'user.account_count', normalizedValue: 16, originalValue: 'Private tenant: 16', valueType: 'number'
|
|
}))).toMatchObject({ property: 'user.account_count', value: 16, disclosureClass: 'aggregate', subjectType: 'active-directory-environment' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'computer.account_count', normalizedValue: 1, valueType: 'number'
|
|
}))).toMatchObject({ value: 1, disclosureClass: 'aggregate' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'user.password_never_expires_count', normalizedValue: 15, valueType: 'number'
|
|
}))).toMatchObject({ value: 15, disclosureClass: 'aggregate' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'pki.certificate_template_count', normalizedValue: 12, valueType: 'number'
|
|
}))).toMatchObject({ value: 12, disclosureClass: 'aggregate' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'password_policy.complexity_enabled', normalizedValue: false, valueType: 'boolean'
|
|
}))).toMatchObject({ value: false, disclosureClass: 'configuration-state' });
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'laps.windows.present', normalizedValue: true, valueType: 'boolean'
|
|
}))).toMatchObject({ value: true, disclosureClass: 'configuration-state' });
|
|
});
|
|
|
|
it('still fails closed for a non-numeric aggregate value', () => {
|
|
expect(discloseSupplementalObservation(observation({
|
|
property: 'user.account_count', normalizedValue: 'sixteen private users', valueType: 'string'
|
|
}))).toBeUndefined();
|
|
});
|
|
});
|