mirror of
https://github.com/hanzoai/bot.git
synced 2026-10-30 17:24:26 +00:00
zeekay
71c1bb3520
Merged 3580 upstream commits from openclaw/main through a bridge branch that applied the openclaw→hanzo-bot rebrand before merging. Key upstream additions: - Android device diagnostics and notification actions - Device-auth v2 migration improvements - Docker CLI packaging fixes - Ollama discovery log demotion - Channel health monitoring - Slack native streaming - Linq iMessage channel - Gemini OAuth and FTS improvements - Inbound sender metadata - Daemon PATH improvements - Canvas host and onboarding enhancements - Security hardening (session files, exec allowlist)
62 lines
2.3 KiB
Swift
62 lines
2.3 KiB
Swift
import Foundation
|
|
import BotKit
|
|
import Testing
|
|
|
|
@Suite struct DeepLinksSecurityTests {
|
|
@Test func gatewayDeepLinkRejectsInsecureNonLoopbackWs() {
|
|
let url = URL(
|
|
string: "bot://gateway?host=attacker.example&port=18789&tls=0&token=abc")!
|
|
#expect(DeepLinkParser.parse(url) == nil)
|
|
}
|
|
|
|
@Test func gatewayDeepLinkRejectsInsecurePrefixBypassHost() {
|
|
let url = URL(
|
|
string: "bot://gateway?host=127.attacker.example&port=18789&tls=0&token=abc")!
|
|
#expect(DeepLinkParser.parse(url) == nil)
|
|
}
|
|
|
|
@Test func gatewayDeepLinkAllowsLoopbackWs() {
|
|
let url = URL(
|
|
string: "bot://gateway?host=127.0.0.1&port=18789&tls=0&token=abc")!
|
|
#expect(
|
|
DeepLinkParser.parse(url) == .gateway(
|
|
.init(host: "127.0.0.1", port: 18789, tls: false, token: "abc", password: nil)))
|
|
}
|
|
|
|
@Test func setupCodeRejectsInsecureNonLoopbackWs() {
|
|
let payload = #"{"url":"ws://attacker.example:18789","token":"tok"}"#
|
|
let encoded = Data(payload.utf8)
|
|
.base64EncodedString()
|
|
.replacingOccurrences(of: "+", with: "-")
|
|
.replacingOccurrences(of: "/", with: "_")
|
|
.replacingOccurrences(of: "=", with: "")
|
|
#expect(GatewayConnectDeepLink.fromSetupCode(encoded) == nil)
|
|
}
|
|
|
|
@Test func setupCodeRejectsInsecurePrefixBypassHost() {
|
|
let payload = #"{"url":"ws://127.attacker.example:18789","token":"tok"}"#
|
|
let encoded = Data(payload.utf8)
|
|
.base64EncodedString()
|
|
.replacingOccurrences(of: "+", with: "-")
|
|
.replacingOccurrences(of: "/", with: "_")
|
|
.replacingOccurrences(of: "=", with: "")
|
|
#expect(GatewayConnectDeepLink.fromSetupCode(encoded) == nil)
|
|
}
|
|
|
|
@Test func setupCodeAllowsLoopbackWs() {
|
|
let payload = #"{"url":"ws://127.0.0.1:18789","token":"tok"}"#
|
|
let encoded = Data(payload.utf8)
|
|
.base64EncodedString()
|
|
.replacingOccurrences(of: "+", with: "-")
|
|
.replacingOccurrences(of: "/", with: "_")
|
|
.replacingOccurrences(of: "=", with: "")
|
|
#expect(
|
|
GatewayConnectDeepLink.fromSetupCode(encoded) == .init(
|
|
host: "127.0.0.1",
|
|
port: 18789,
|
|
tls: false,
|
|
token: "tok",
|
|
password: nil))
|
|
}
|
|
}
|