implementer
719fb4380b
The Docker-gated probe only planted a root-level .env.t08-* marker, which no Dockerfile COPY instruction ever copies — so it could not observe a nested build-context leak in the image layers. Plant additional marker files at nested paths the Dockerfile's COPY apps/server apps/server would sweep into the build-stage image (apps/server/.env.t08-*, apps/server/secrets/t08-*.pem) so the end-to-end scan actually verifies the 'any depth' exclusion guarantee, not just the root form.
844 lines
35 KiB
JavaScript
844 lines
35 KiB
JavaScript
/**
|
|
* Secrets-not-embedded test — locks in the [E00-S02-T08] guarantee that no
|
|
* secrets are embedded in the workspace server application image.
|
|
*
|
|
* Acceptance criteria covered (each test fails without the committed state):
|
|
* - "secrets are not embedded in the image" → the committed
|
|
* `apps/server/Dockerfile` declares no secret-bearing `ARG`/`ENV`
|
|
* instruction (the only ENV is `NODE_ENV=production`) and every `COPY`
|
|
* copies a fixed, non-secret path — never `.env` or credential files, and
|
|
* never a blanket `COPY . .` of the whole context; the committed
|
|
* `.dockerignore` excludes local env + credential files from the build
|
|
* context at the context root AND at any nested depth (`**`-prefixed
|
|
* patterns — Docker's matcher anchors slash-less patterns to the context
|
|
* root, so a bare `.npmrc`/`*.key`/`secrets` would exclude nothing under
|
|
* `apps/server/…`), so a developer's secret file cannot be embedded even
|
|
* by mistake; and the committed files the Dockerfile copies into the image
|
|
* contain no default credential values. The mutation probes below prove
|
|
* the assertions are non-vacuous (adding a secret ENV/ARG, a credential
|
|
* URI value, a `COPY` of `.env`, a blanket `COPY . .`, dropping a
|
|
* `.dockerignore` exclusion, replacing a `**`-prefixed pattern with its
|
|
* root-anchored bare form, or adding a redundant equivalent pattern all
|
|
* break the criterion).
|
|
* - "image layers contain no secret values" → on machines with Docker, the
|
|
* real-image probe builds the committed image from the repo root with
|
|
* marker-bearing probe files planted in the build context at the root
|
|
* (`.env.t08-*`) AND at nested paths the Dockerfile's
|
|
* `COPY apps/server apps/server` would sweep into the build-stage image
|
|
* (`apps/server/.env.t08-*`, `apps/server/secrets/t08-*.pem`) unless
|
|
* `.dockerignore` excludes them, then `docker save`s the image, extracts
|
|
* every layer (raw + decompressed) and the image config, and confirms
|
|
* neither the markers nor the compose default credential values appear
|
|
* anywhere in the layers. CI runs this file on every PR
|
|
* (.gitea/workflows/ci.yml), so the static assertions gate merges.
|
|
*
|
|
* The dockerignore matcher below is a faithful port of Docker's real matcher,
|
|
* moby/patternmatcher (patternmatcher.go): every pattern is `filepath.Clean`ed
|
|
* (so `secrets` and `secrets/` are the SAME pattern), compiled to an anchored
|
|
* full-path matcher (exact / trailing-`**` prefix / leading-`**`+separator suffix /
|
|
* regexp), and a path matches when a pattern matches it OR any of its parent
|
|
* directories (docker prunes a matched directory, taking everything under it).
|
|
* It is deliberately NOT gitignore-basename matching: a slash-less pattern
|
|
* only matches at the context root.
|
|
*
|
|
* Run: `node --test tests/secrets-not-embedded.test.mjs`
|
|
* (node:test — built into Node >= 18; no dependencies, lockfile untouched.)
|
|
*/
|
|
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {
|
|
existsSync,
|
|
mkdirSync,
|
|
mkdtempSync,
|
|
readdirSync,
|
|
readFileSync,
|
|
rmSync,
|
|
statSync,
|
|
unlinkSync,
|
|
writeFileSync,
|
|
} from 'node:fs';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { randomUUID } from 'node:crypto';
|
|
import { gunzipSync } from 'node:zlib';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
|
|
|
|
const read = (relPath) => readFileSync(path.join(REPO_ROOT, relPath), 'utf8');
|
|
|
|
/** The committed app image definition and build context filters under test. */
|
|
const DOCKERFILE_PATH = 'apps/server/Dockerfile';
|
|
const DOCKERIGNORE_PATH = '.dockerignore';
|
|
|
|
/**
|
|
* Env/credential path patterns that must never enter the image. The committed
|
|
* `.dockerignore` must exclude every one of them, and no Dockerfile `COPY` may
|
|
* target a path matching one. Keep in sync with the committed `.dockerignore`.
|
|
*
|
|
* Every pattern is `**`-prefixed: Docker's matcher (moby/patternmatcher)
|
|
* anchors a slash-less pattern to the context root, so a bare `.npmrc`/
|
|
* `*.key`/`secrets` would exclude nothing under `apps/server/…`. A `**`-
|
|
* prefixed `foo` matches `foo` at the root AND at any nested depth.
|
|
*/
|
|
const SECRET_PATH_PATTERNS = [
|
|
'**/.env',
|
|
'**/.env.*',
|
|
'**/node_modules',
|
|
'**/.npmrc',
|
|
'**/.netrc',
|
|
'**/.credentials',
|
|
'**/.aws',
|
|
'**/.ssh',
|
|
'**/secrets',
|
|
'**/*.pem',
|
|
'**/*.key',
|
|
'**/*.p12',
|
|
'**/*.pfx',
|
|
'**/*.jks',
|
|
'**/id_rsa',
|
|
'**/id_ed25519',
|
|
];
|
|
|
|
/**
|
|
* One representative NESTED context path per required pattern — the acceptance
|
|
* criteria call these out explicitly (`apps/server/.npmrc`, `config/server.key`,
|
|
* `apps/server/secrets/…`). The committed `.dockerignore` (the full pattern
|
|
* set) must exclude every one of them under Docker's anchored matcher.
|
|
*/
|
|
const SECRET_PATH_EXAMPLES = [
|
|
['**/.env', 'apps/server/.env'],
|
|
['**/.env.*', 'apps/server/.env.local'],
|
|
['**/node_modules', 'apps/server/node_modules/pkg/index.js'],
|
|
['**/.npmrc', 'apps/server/.npmrc'],
|
|
['**/.netrc', 'packages/core/.netrc'],
|
|
['**/.credentials', 'config/.credentials'],
|
|
['**/.aws', 'apps/server/.aws/credentials'],
|
|
['**/.ssh', 'apps/server/.ssh/id_ed25519'],
|
|
['**/secrets', 'apps/server/secrets/db.pem'],
|
|
['**/*.pem', 'config/server.pem'],
|
|
['**/*.key', 'config/server.key'],
|
|
['**/*.p12', 'certs/app.p12'],
|
|
['**/*.pfx', 'certs/app.pfx'],
|
|
['**/*.jks', 'certs/app.jks'],
|
|
['**/id_rsa', 'apps/server/id_rsa'],
|
|
['**/id_ed25519', 'apps/server/.ssh/id_ed25519'],
|
|
];
|
|
|
|
/** Default credential values committed in compose.yaml (dev-only defaults). */
|
|
const COMPOSE_CREDENTIAL_VALUES = [
|
|
'postgres://eppp:eppp@db:5432/eppp',
|
|
'eppp',
|
|
];
|
|
|
|
/** Variable names that must never appear on an ARG/ENV instruction. */
|
|
const SECRET_NAME_RE =
|
|
/(password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret|private[_-]?key|credential|database[_-]?url)\b/i;
|
|
|
|
/** A credential URI (`scheme://user:pass@host`) embedded as a literal value. */
|
|
const CREDENTIAL_URI_RE = /:\/\/[^/\s]+:[^@\s]+@/;
|
|
|
|
/** A long random-looking value (JWT/API-key/token-shaped literal). */
|
|
const LONG_SECRET_RE = /^[A-Za-z0-9+/=_-]{32,}$/;
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Dockerfile structure helpers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* Extracts every single-line `ENV`/`ARG` instruction from the committed
|
|
* Dockerfile. (The committed file uses single-line instructions; like the
|
|
* repo's block-YAML parser, this supports the subset the committed file uses.)
|
|
*/
|
|
function envArgInstructions(dockerfile) {
|
|
const instructions = [];
|
|
for (const line of dockerfile.split(/\r?\n/)) {
|
|
const match = /^\s*(ENV|ARG)\s+(.+)$/.exec(line);
|
|
if (match) instructions.push({ kind: match[1], rest: match[2].trim() });
|
|
}
|
|
return instructions;
|
|
}
|
|
|
|
/** Splits one `ENV key=value` / `ENV key value` / `ARG key[=value]` line. */
|
|
function parseInstruction(rest) {
|
|
const eq = rest.indexOf('=');
|
|
const sp = rest.search(/\s/);
|
|
if (eq !== -1 && (sp === -1 || eq < sp)) {
|
|
return { name: rest.slice(0, eq).trim(), value: rest.slice(eq + 1).trim() };
|
|
}
|
|
if (sp !== -1) {
|
|
return { name: rest.slice(0, sp).trim(), value: rest.slice(sp + 1).trim() };
|
|
}
|
|
return { name: rest.trim(), value: '' };
|
|
}
|
|
|
|
/** Extracts every single-line `COPY` instruction (raw argument list). */
|
|
function copyInstructions(dockerfile) {
|
|
const copies = [];
|
|
for (const line of dockerfile.split(/\r?\n/)) {
|
|
const match = /^\s*COPY\s+(.+)$/.exec(line);
|
|
if (match) copies.push(match[1].trim());
|
|
}
|
|
return copies;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Docker-faithful .dockerignore matching (moby/patternmatcher port)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* POSIX `filepath.Clean` for the pattern/path forms this repo uses (moby's
|
|
* patternmatcher runs every pattern through `filepath.Clean` before compiling
|
|
* it): collapses repeated separators, resolves `.`/`..`, and drops a trailing
|
|
* separator — so `secrets` and `secrets/` are the SAME pattern, and `./x`
|
|
* is `x`.
|
|
*/
|
|
function cleanPath(p) {
|
|
if (p === '') return '.';
|
|
const rooted = p.startsWith('/');
|
|
const out = [];
|
|
let dotdot = 0; // `..` may not backtrack past this index
|
|
for (const part of p.split('/')) {
|
|
if (part === '' || part === '.') continue;
|
|
if (part === '..') {
|
|
if (out.length > dotdot) {
|
|
out.pop();
|
|
} else if (!rooted) {
|
|
out.push('..');
|
|
dotdot = out.length;
|
|
}
|
|
continue;
|
|
}
|
|
out.push(part);
|
|
}
|
|
const result = `${rooted ? '/' : ''}${out.join('/')}`;
|
|
return result === '' ? '.' : result;
|
|
}
|
|
|
|
/**
|
|
* Compiles one cleaned pattern exactly as moby/patternmatcher's `compile`
|
|
* does: a leading `**` followed by a separator becomes an optional
|
|
* "any segments" group `(.*` + separator + `)?` (or, when followed only by
|
|
* literal chars, a suffix match that also matches the root form); a trailing
|
|
* `**` becomes a prefix match; a mid-pattern `**` becomes the same optional
|
|
* group; `*`/`?` become `[^/]*`/`[^/]`; regexp metachars are escaped. A
|
|
* pattern with no globs is an exact full-path match.
|
|
*
|
|
* Returns `{ cleanedPattern, matchType, regexp }` with matchType one of
|
|
* 'exact' | 'prefix' | 'suffix' | 'regexp'.
|
|
*/
|
|
function compilePattern(cleaned) {
|
|
let regStr = '^';
|
|
let matchType = 'exact';
|
|
let iter = 0; // Go scanner iteration counter (i in patternmatcher.go)
|
|
let i = 0;
|
|
const n = cleaned.length;
|
|
while (i < n) {
|
|
const ch = cleaned[i];
|
|
if (ch === '*') {
|
|
if (i + 1 < n && cleaned[i + 1] === '*') {
|
|
i += 2;
|
|
// Treat "**/" as "**" — eat the following separator.
|
|
if (i < n && cleaned[i] === '/') i += 1;
|
|
if (i >= n) {
|
|
// Trailing "**": match everything from here on.
|
|
if (matchType === 'exact') matchType = 'prefix';
|
|
else {
|
|
regStr += '.*';
|
|
matchType = 'regexp';
|
|
}
|
|
} else {
|
|
// Mid-pattern "**": any number of segments (incl. zero).
|
|
regStr += '(.*/)?';
|
|
matchType = 'regexp';
|
|
}
|
|
// A leading "**/..." with no further globs is a suffix match.
|
|
if (iter === 0) matchType = 'suffix';
|
|
} else {
|
|
// "*" matches anything but a separator.
|
|
regStr += '[^/]*';
|
|
matchType = 'regexp';
|
|
i += 1;
|
|
}
|
|
} else if (ch === '?') {
|
|
regStr += '[^/]';
|
|
matchType = 'regexp';
|
|
i += 1;
|
|
} else if ('.+()|{}$'.includes(ch)) {
|
|
// Regexp metachars that are not filepath pattern chars get escaped.
|
|
regStr += `\\${ch}`;
|
|
i += 1;
|
|
} else if (ch === '\\') {
|
|
// Escape the next char (a trailing lone backslash is kept literal).
|
|
if (i + 1 < n) {
|
|
regStr += `\\${cleaned[i + 1]}`;
|
|
i += 2;
|
|
matchType = 'regexp';
|
|
} else {
|
|
regStr += '\\';
|
|
i += 1;
|
|
}
|
|
} else if (ch === '[' || ch === ']') {
|
|
// Brackets are passed through to the regexp (char classes).
|
|
regStr += ch;
|
|
matchType = 'regexp';
|
|
i += 1;
|
|
} else {
|
|
regStr += ch;
|
|
i += 1;
|
|
}
|
|
iter += 1;
|
|
}
|
|
let regexp = null;
|
|
if (matchType === 'regexp') {
|
|
regStr += '$';
|
|
regexp = new RegExp(regStr);
|
|
}
|
|
return { cleanedPattern: cleaned, matchType, regexp };
|
|
}
|
|
|
|
/** Matches one compiled pattern against a full cleaned path (pattern.match). */
|
|
function patternMatches(pattern, path) {
|
|
const { cleanedPattern, matchType, regexp } = pattern;
|
|
if (matchType === 'exact') return path === cleanedPattern;
|
|
if (matchType === 'prefix') return path.startsWith(cleanedPattern.slice(0, -2));
|
|
if (matchType === 'suffix') {
|
|
const suffix = cleanedPattern.slice(2);
|
|
if (path.endsWith(suffix)) return true;
|
|
// "**/foo" also matches the bare "foo" at the context root.
|
|
return suffix.startsWith('/') && path === suffix.slice(1);
|
|
}
|
|
if (matchType === 'regexp') return regexp.test(path);
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Parses `.dockerignore` text the way docker does (trim, skip blanks and `#`
|
|
* comments) and compiles every pattern via the moby/patternmatcher pipeline
|
|
* (TrimSpace, filepath.Clean, optional `!` exclusion prefix).
|
|
*/
|
|
function dockerignorePatterns(dockerignoreText) {
|
|
const patterns = [];
|
|
for (const rawLine of dockerignoreText.split(/\r?\n/)) {
|
|
let line = rawLine.trim();
|
|
if (line === '' || line.startsWith('#')) continue;
|
|
line = cleanPath(line);
|
|
let exclusion = false;
|
|
if (line.startsWith('!')) {
|
|
if (line.length === 1) throw new Error('illegal exclusion pattern: "!"');
|
|
exclusion = true;
|
|
line = line.slice(1);
|
|
}
|
|
patterns.push({ exclusion, ...compilePattern(line) });
|
|
}
|
|
return patterns;
|
|
}
|
|
|
|
/**
|
|
* Docker's MatchesOrParentMatches: true when `relPath` (context-relative) is
|
|
* excluded by any of the compiled patterns. A pattern matches the full cleaned
|
|
* path OR any of its parent directories (docker prunes a matched directory,
|
|
* taking everything under it). A slash-less pattern is anchored to the context
|
|
* ROOT — exactly as in moby/patternmatcher — so only `**`-prefixed patterns
|
|
* reach nested paths.
|
|
*/
|
|
function matchesDockerignore(patterns, relPath) {
|
|
const file = cleanPath(relPath);
|
|
if (file === '.') return false;
|
|
const parent = file.includes('/') ? file.slice(0, file.lastIndexOf('/')) : '.';
|
|
const parentDirs = parent === '.' ? [] : parent.split('/');
|
|
let matched = false;
|
|
for (const pattern of patterns) {
|
|
if (pattern.exclusion !== matched) continue;
|
|
let m = patternMatches(pattern, file);
|
|
if (!m && parent !== '.') {
|
|
for (let i = 0; i < parentDirs.length; i += 1) {
|
|
m = patternMatches(pattern, parentDirs.slice(0, i + 1).join('/'));
|
|
if (m) break;
|
|
}
|
|
}
|
|
if (m) matched = !pattern.exclusion;
|
|
}
|
|
return matched;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Criterion assertions
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/**
|
|
* Asserts the committed Dockerfile embeds no secrets:
|
|
* - no `ARG`/`ENV` instruction names a secret-bearing variable, embeds a
|
|
* credential URI, or embeds a long secret-looking literal (runtime
|
|
* credentials belong in Compose environment, never in the image);
|
|
* - every `COPY` copies fixed, non-secret paths — none matches a
|
|
* `SECRET_PATH_PATTERNS` pattern and none is a blanket copy of the whole
|
|
* build context (`COPY . .`) that could sweep env/credential files in.
|
|
*/
|
|
function assertNoSecretsEmbedded(dockerfile) {
|
|
const instructions = envArgInstructions(dockerfile);
|
|
for (const { kind, rest } of instructions) {
|
|
const { name, value } = parseInstruction(rest);
|
|
assert.doesNotMatch(
|
|
name,
|
|
SECRET_NAME_RE,
|
|
`the Dockerfile must not declare a secret-bearing ${kind} variable (got "${name}") — ` +
|
|
'runtime credentials belong in Compose environment (compose.yaml), never baked into the image',
|
|
);
|
|
assert.doesNotMatch(
|
|
value,
|
|
CREDENTIAL_URI_RE,
|
|
`the Dockerfile ${kind} "${name}" must not embed a credential URI (got "${value}")`,
|
|
);
|
|
assert.doesNotMatch(
|
|
value,
|
|
LONG_SECRET_RE,
|
|
`the Dockerfile ${kind} "${name}" must not embed a long secret-looking value (got "${value}")`,
|
|
);
|
|
}
|
|
|
|
const copies = copyInstructions(dockerfile);
|
|
assert.ok(
|
|
copies.length > 0,
|
|
'the Dockerfile must declare COPY instructions (the app files must reach the image)',
|
|
);
|
|
const secretPatterns = dockerignorePatterns(SECRET_PATH_PATTERNS.join('\n'));
|
|
for (const copy of copies) {
|
|
const tokens = copy.split(/\s+/).filter((token) => !token.startsWith('--from='));
|
|
const sources = tokens.slice(0, -1).filter((token) => !token.startsWith('/'));
|
|
for (const src of sources) {
|
|
assert.notEqual(
|
|
src.replace(/\/+$/, ''),
|
|
'.',
|
|
'the Dockerfile must not COPY the whole build context (COPY . ...) — env/credential files could be swept into the image',
|
|
);
|
|
assert.ok(
|
|
!matchesDockerignore(secretPatterns, src),
|
|
`the Dockerfile COPY must not copy a secret/credential path (got "${src}") — the build context ` +
|
|
'excludes env/credential files at any depth via .dockerignore',
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Asserts the committed `.dockerignore` excludes every `SECRET_PATH_PATTERNS`
|
|
* entry — at the context root AND at any nested depth — so a developer's
|
|
* env/credential files never enter the build context, the first line of
|
|
* defense against embedding secrets in the image. Concretely:
|
|
* - every required `**`-prefixed pattern is present verbatim (a bare
|
|
* `.npmrc`/`*.key`/`secrets` would only exclude the context root);
|
|
* - no two patterns clean to the same path (redundant equivalent patterns
|
|
* such as `secrets` + `secrets/` are never required);
|
|
* - every representative NESTED example path is excluded by the full pattern
|
|
* set under the Docker-faithful matcher.
|
|
*/
|
|
function assertDockerignoreExcludesSecrets(dockerignore) {
|
|
const compiled = dockerignorePatterns(dockerignore);
|
|
const cleaned = compiled.map((p) => p.cleanedPattern);
|
|
for (const required of SECRET_PATH_PATTERNS) {
|
|
assert.ok(
|
|
cleaned.includes(required),
|
|
`.dockerignore must exclude "${required}" (the **/-prefixed form, so the pattern applies at the ` +
|
|
`context root AND any nested depth — Docker's matcher anchors slash-less patterns to the root) ` +
|
|
`(got: ${cleaned.join(', ')})`,
|
|
);
|
|
}
|
|
assert.equal(
|
|
new Set(cleaned).size,
|
|
cleaned.length,
|
|
`.dockerignore must not contain redundant equivalent patterns (two patterns that clean to the same ` +
|
|
`path, e.g. \`secrets\` and \`secrets/\`, add nothing) (got: ${cleaned.join(', ')})`,
|
|
);
|
|
for (const [pattern, example] of SECRET_PATH_EXAMPLES) {
|
|
assert.ok(
|
|
matchesDockerignore(compiled, example),
|
|
`.dockerignore must exclude the nested example path "${example}" (via "${pattern}") so a local ` +
|
|
'secret file cannot be embedded even by mistake',
|
|
);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Asserts none of the committed files that the Dockerfile copies into the
|
|
* image contains a default credential value — source-level proof that the
|
|
* image's inputs carry no secrets.
|
|
*/
|
|
function assertCopiedFilesHaveNoCredentials(contentsByPath) {
|
|
for (const [relPath, text] of contentsByPath) {
|
|
for (const needle of COMPOSE_CREDENTIAL_VALUES) {
|
|
assert.ok(
|
|
!text.includes(needle),
|
|
`committed file "${relPath}" (copied into the image) must not contain the default credential value ` +
|
|
`"${needle}" — a secret would be embedded in the image`,
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Collects the committed files the Dockerfile COPY instructions pull from the
|
|
* repo (stage-local `/...` sources and `--from=` flags are ignored) as a
|
|
* `Map<relPath, text>`. Directories are walked; gitignored build output and
|
|
* dependency trees are skipped (they are not committed image inputs).
|
|
*/
|
|
function copiedFileContents(dockerfile) {
|
|
const contents = new Map();
|
|
const SKIP_DIRS = new Set(['node_modules', '.pnpm-store', 'dist', 'coverage', '.git']);
|
|
|
|
const addPath = (relPath) => {
|
|
const full = path.join(REPO_ROOT, relPath);
|
|
if (!existsSync(full)) return;
|
|
const st = statSync(full);
|
|
if (st.isDirectory()) {
|
|
for (const entry of readdirSync(full)) {
|
|
if (SKIP_DIRS.has(entry)) continue;
|
|
addPath(path.posix.join(relPath, entry));
|
|
}
|
|
return;
|
|
}
|
|
try {
|
|
contents.set(relPath, readFileSync(full, 'utf8'));
|
|
} catch {
|
|
// unreadable/binary files are not text inputs; skip
|
|
}
|
|
};
|
|
|
|
for (const copy of copyInstructions(dockerfile)) {
|
|
const tokens = copy.split(/\s+/).filter((token) => !token.startsWith('--from='));
|
|
const sources = tokens.slice(0, -1).filter((token) => !token.startsWith('/'));
|
|
for (const src of sources) {
|
|
const rel = src.replace(/^\.\//, '');
|
|
if (rel === '.' || rel === '') continue;
|
|
addPath(rel);
|
|
}
|
|
}
|
|
return contents;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Docker probe helpers (integration tests skip cleanly without Docker)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
function run(cmd, args, opts = {}) {
|
|
return spawnSync(cmd, args, {
|
|
encoding: 'utf8',
|
|
timeout: 600_000,
|
|
...opts,
|
|
});
|
|
}
|
|
|
|
/** True when a reachable Docker daemon exists. */
|
|
function dockerDaemonAvailable() {
|
|
try {
|
|
return run('docker', ['info'], { timeout: 15_000 }).status === 0;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
const DOCKER_DAEMON = dockerDaemonAvailable();
|
|
|
|
/**
|
|
* Walks `dir`, returning which of `needles` occur in any file's raw content or
|
|
* (for gzip-compressed layer blobs) its decompressed content. The image config
|
|
* JSON is part of the save output, so baked `ENV` secrets are caught too.
|
|
*/
|
|
function anyFileContains(dir, needles) {
|
|
const needleBufs = needles.map((needle) => Buffer.from(needle, 'utf8'));
|
|
const found = new Set();
|
|
|
|
const walk = (d) => {
|
|
for (const entry of readdirSync(d)) {
|
|
const full = path.join(d, entry);
|
|
const st = statSync(full);
|
|
if (st.isDirectory()) {
|
|
walk(full);
|
|
continue;
|
|
}
|
|
const bufs = [readFileSync(full)];
|
|
const raw = bufs[0];
|
|
if (raw.length > 2 && raw[0] === 0x1f && raw[1] === 0x8b) {
|
|
try {
|
|
bufs.push(gunzipSync(raw));
|
|
} catch {
|
|
// not a real gzip stream — raw content is already searched
|
|
}
|
|
}
|
|
for (const buf of bufs) {
|
|
for (let i = 0; i < needleBufs.length; i += 1) {
|
|
if (buf.indexOf(needleBufs[i]) !== -1) found.add(needles[i]);
|
|
}
|
|
}
|
|
}
|
|
};
|
|
|
|
walk(dir);
|
|
return [...found];
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Criterion tests
|
|
// ---------------------------------------------------------------------------
|
|
|
|
test('the app image embeds no secrets (Dockerfile declares no secret ENV/ARG and copies no secret paths)', () => {
|
|
assert.ok(existsSync(path.join(REPO_ROOT, DOCKERFILE_PATH)), `committed ${DOCKERFILE_PATH} must exist`);
|
|
assertNoSecretsEmbedded(read(DOCKERFILE_PATH));
|
|
});
|
|
|
|
test('the build context excludes env and credential files (.dockerignore)', () => {
|
|
assert.ok(
|
|
existsSync(path.join(REPO_ROOT, DOCKERIGNORE_PATH)),
|
|
`committed ${DOCKERIGNORE_PATH} must exist so local secrets stay out of the build context`,
|
|
);
|
|
assertDockerignoreExcludesSecrets(read(DOCKERIGNORE_PATH));
|
|
});
|
|
|
|
test('the committed files copied into the image contain no default credential values', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const contents = copiedFileContents(dockerfile);
|
|
assert.ok(contents.size > 0, 'the Dockerfile must copy committed files that the test can scan');
|
|
assertCopiedFilesHaveNoCredentials(contents);
|
|
});
|
|
|
|
test('the built image layers contain no secret values (docker build + layer scan)', { skip: !DOCKER_DAEMON }, () => {
|
|
// Build the committed image from the repo root with marker-bearing probe
|
|
// files planted in the build context at the root AND at nested paths the
|
|
// Dockerfile's `COPY apps/server apps/server` would sweep into the
|
|
// build-stage image if `.dockerignore` did not exclude them:
|
|
// - .env.t08-<uuid> (root; `**/.env.*`)
|
|
// - apps/server/.env.t08-<uuid> (nested; `**/.env.*`)
|
|
// - apps/server/secrets/t08-<uuid>.pem (nested; `**/secrets`, `**/*.pem`)
|
|
// then scan every layer blob (raw + decompressed) and the image config for
|
|
// the markers and the compose default credential values. The nested markers
|
|
// are the observable end-to-end check of the "any depth" guarantee: a leak
|
|
// at apps/server/… would land in the build-stage layers via the COPY.
|
|
const rootMarker = `T08_ROOT_SECRET_${randomUUID().replace(/-/g, '')}`;
|
|
const nestedEnvMarker = `T08_NESTED_ENV_SECRET_${randomUUID().replace(/-/g, '')}`;
|
|
const nestedPemMarker = `T08_NESTED_PEM_SECRET_${randomUUID().replace(/-/g, '')}`;
|
|
const rootProbeName = `.env.t08-${randomUUID().slice(0, 8)}`;
|
|
const nestedEnvProbeName = `.env.t08-${randomUUID().slice(0, 8)}`;
|
|
const nestedPemName = `t08-${randomUUID().slice(0, 8)}.pem`;
|
|
const tag = `personal-blog:t08-probe-${randomUUID().slice(0, 8)}`;
|
|
const tmp = mkdtempSync(path.join(os.tmpdir(), 't08-layer-scan-'));
|
|
const rootProbePath = path.join(REPO_ROOT, rootProbeName);
|
|
const nestedEnvProbePath = path.join(REPO_ROOT, 'apps/server', nestedEnvProbeName);
|
|
const secretsDir = path.join(REPO_ROOT, 'apps/server/secrets');
|
|
const nestedPemPath = path.join(secretsDir, nestedPemName);
|
|
const hadSecretsDir = existsSync(secretsDir);
|
|
|
|
try {
|
|
writeFileSync(rootProbePath, `T08_PROBE_ROOT_SECRET=${rootMarker}\n`);
|
|
writeFileSync(nestedEnvProbePath, `T08_PROBE_NESTED_ENV_SECRET=${nestedEnvMarker}\n`);
|
|
mkdirSync(secretsDir, { recursive: true });
|
|
writeFileSync(nestedPemPath, `T08_PROBE_NESTED_PEM_SECRET=${nestedPemMarker}\n`);
|
|
|
|
const build = run('docker', ['build', '--file', 'apps/server/Dockerfile', '--tag', tag, '.'], {
|
|
cwd: REPO_ROOT,
|
|
});
|
|
assert.equal(
|
|
build.status,
|
|
0,
|
|
`"docker build" must exit 0:\n${(build.stdout || '')}\n${(build.stderr || '')}`.trim(),
|
|
);
|
|
|
|
const save = run('docker', ['save', '--output', path.join(tmp, 'image.tar'), tag], { timeout: 300_000 });
|
|
assert.equal(
|
|
save.status,
|
|
0,
|
|
`"docker save" must exit 0:\n${(save.stdout || '')}\n${(save.stderr || '')}`.trim(),
|
|
);
|
|
|
|
const extractDir = path.join(tmp, 'extracted');
|
|
mkdirSync(extractDir, { recursive: true });
|
|
const untar = run('tar', ['-xf', path.join(tmp, 'image.tar'), '-C', extractDir], { timeout: 300_000 });
|
|
assert.equal(
|
|
untar.status,
|
|
0,
|
|
`"tar -xf" must exit 0:\n${(untar.stdout || '')}\n${(untar.stderr || '')}`.trim(),
|
|
);
|
|
|
|
const found = anyFileContains(extractDir, [rootMarker, nestedEnvMarker, nestedPemMarker, ...COMPOSE_CREDENTIAL_VALUES]);
|
|
assert.deepEqual(
|
|
found,
|
|
[],
|
|
`the image layers must contain no secret values; found in the image: ${found.join(', ')} ` +
|
|
`(scan of every layer + image config of "${tag}"; probe files planted at the root (${rootProbeName}) ` +
|
|
`and at nested paths (apps/server/${nestedEnvProbeName}, apps/server/secrets/${nestedPemName}) — ` +
|
|
`see \`docker history ${tag}\` for the layer list)`,
|
|
);
|
|
} finally {
|
|
try {
|
|
unlinkSync(rootProbePath);
|
|
} catch {
|
|
// probe file already gone
|
|
}
|
|
try {
|
|
unlinkSync(nestedEnvProbePath);
|
|
} catch {
|
|
// probe file already gone
|
|
}
|
|
try {
|
|
unlinkSync(nestedPemPath);
|
|
} catch {
|
|
// probe file already gone
|
|
}
|
|
if (!hadSecretsDir) rmSync(secretsDir, { recursive: true, force: true });
|
|
rmSync(tmp, { recursive: true, force: true });
|
|
run('docker', ['image', 'rm', '-f', tag]);
|
|
}
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Non-vacuous probes — the assertions above really do fail on violations
|
|
// ---------------------------------------------------------------------------
|
|
|
|
test('adding a secret-bearing ENV makes the no-secrets criterion fail (mutation probe)', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const mutated = `${dockerfile}\nENV POSTGRES_PASSWORD=not-a-real-secret\n`;
|
|
assert.throws(() => assertNoSecretsEmbedded(mutated), /POSTGRES_PASSWORD/);
|
|
});
|
|
|
|
test('adding an ARG with a secret name makes the no-secrets criterion fail (mutation probe)', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const mutated = `${dockerfile}\nARG DATABASE_URL=postgres://eppp:eppp@db:5432/eppp\n`;
|
|
assert.throws(() => assertNoSecretsEmbedded(mutated), /DATABASE_URL/);
|
|
});
|
|
|
|
test('embedding a credential URI in an ENV value fails the no-secrets criterion (mutation probe)', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const mutated = dockerfile.replace(
|
|
'ENV NODE_ENV=production',
|
|
'ENV NODE_ENV=production\nENV DB_URI=postgres://user:pass@host:5432/db',
|
|
);
|
|
assert.notEqual(mutated, dockerfile, 'the mutation must actually add the credential URI ENV');
|
|
assert.throws(() => assertNoSecretsEmbedded(mutated), /credential URI/);
|
|
});
|
|
|
|
test('a long secret-looking ENV value fails the no-secrets criterion (mutation probe)', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const mutated = dockerfile.replace(
|
|
'ENV NODE_ENV=production',
|
|
'ENV NODE_ENV=production\nENV SOMETHING=abcdef0123456789ABCDEF0123456789abcdef0123456789',
|
|
);
|
|
assert.notEqual(mutated, dockerfile, 'the mutation must actually add the long value ENV');
|
|
assert.throws(() => assertNoSecretsEmbedded(mutated), /long secret-looking/);
|
|
});
|
|
|
|
test('COPYing .env into the image fails the no-secrets criterion (mutation probe)', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const mutated = dockerfile.replace(
|
|
'COPY apps/server apps/server',
|
|
'COPY apps/server apps/server\nCOPY .env .env',
|
|
);
|
|
assert.notEqual(mutated, dockerfile, 'the mutation must actually add the .env COPY');
|
|
assert.throws(() => assertNoSecretsEmbedded(mutated), /\.env/);
|
|
});
|
|
|
|
test('a blanket COPY of the whole build context fails the no-secrets criterion (mutation probe)', () => {
|
|
const dockerfile = read(DOCKERFILE_PATH);
|
|
const mutated = dockerfile.replace('COPY apps/server apps/server', 'COPY . .');
|
|
assert.notEqual(mutated, dockerfile, 'the mutation must actually add the blanket COPY');
|
|
assert.throws(() => assertNoSecretsEmbedded(mutated), /whole build context/);
|
|
});
|
|
|
|
test('removing **/.env.* from .dockerignore fails the exclusion criterion (mutation probe)', () => {
|
|
const dockerignore = read(DOCKERIGNORE_PATH);
|
|
const mutated = dockerignore.replace(/^\*\*\/\.env\.\*\s*$/m, '');
|
|
assert.notEqual(mutated, dockerignore, 'the mutation must actually remove the **/.env.* pattern');
|
|
assert.throws(() => assertDockerignoreExcludesSecrets(mutated), /\.env\.\*/);
|
|
});
|
|
|
|
test('removing a credential pattern (**/*.key) from .dockerignore fails the exclusion criterion (mutation probe)', () => {
|
|
const dockerignore = read(DOCKERIGNORE_PATH);
|
|
const mutated = dockerignore.replace(/^\*\*\/\*\.key\s*$/m, '');
|
|
assert.notEqual(mutated, dockerignore, 'the mutation must actually remove the **/*.key pattern');
|
|
assert.throws(() => assertDockerignoreExcludesSecrets(mutated), /\.key/);
|
|
});
|
|
|
|
test('replacing a **/-prefixed exclusion with its root-anchored bare form fails (mutation probe)', () => {
|
|
// A bare `secrets` matches only the context root in Docker's matcher, so it
|
|
// cannot satisfy the "excluded at any depth" criterion — only `**/secrets`
|
|
// can. This locks in why the committed patterns are `**/`-prefixed.
|
|
const dockerignore = read(DOCKERIGNORE_PATH);
|
|
const mutated = dockerignore.replace('**/secrets', 'secrets');
|
|
assert.notEqual(mutated, dockerignore, 'the mutation must actually replace **/secrets with secrets');
|
|
assert.throws(() => assertDockerignoreExcludesSecrets(mutated), /secrets/);
|
|
});
|
|
|
|
test('redundant equivalent .dockerignore patterns (secrets + secrets/) fail the exclusion criterion (mutation probe)', () => {
|
|
// `secrets` and `secrets/` clean to the same path, so requiring both is
|
|
// redundant; the no-redundancy assertion must catch them.
|
|
const dockerignore = read(DOCKERIGNORE_PATH);
|
|
const mutated = dockerignore.replace('**/secrets', 'secrets\nsecrets/');
|
|
assert.notEqual(mutated, dockerignore, 'the mutation must actually split **/secrets into the bare forms');
|
|
assert.throws(() => assertDockerignoreExcludesSecrets(mutated), /secrets/);
|
|
});
|
|
|
|
test('a copied committed file containing a default credential value fails (mutation probe)', () => {
|
|
const contents = new Map([
|
|
['apps/server/src/index.ts', 'const url = "postgres://eppp:eppp@db:5432/eppp";'],
|
|
]);
|
|
assert.throws(() => assertCopiedFilesHaveNoCredentials(contents), /postgres:\/\/eppp:eppp@db:5432\/eppp/);
|
|
});
|
|
|
|
test('the dockerignore matcher is Docker-faithful and excludes nested credential paths (parser probe)', () => {
|
|
const patterns = dockerignorePatterns(read(DOCKERIGNORE_PATH));
|
|
|
|
// The nested example paths the acceptance criteria call out are excluded.
|
|
assert.ok(matchesDockerignore(patterns, 'apps/server/.npmrc'), 'apps/server/.npmrc must be excluded');
|
|
assert.ok(matchesDockerignore(patterns, 'config/server.key'), 'config/server.key must be excluded');
|
|
assert.ok(matchesDockerignore(patterns, 'apps/server/secrets/db.pem'), 'apps/server/secrets/db.pem must be excluded');
|
|
assert.ok(matchesDockerignore(patterns, 'apps/server/.env'), 'apps/server/.env must be excluded');
|
|
assert.ok(matchesDockerignore(patterns, 'apps/server/.env.local'), 'apps/server/.env.local must be excluded');
|
|
assert.ok(
|
|
matchesDockerignore(patterns, 'apps/server/node_modules/pkg/index.js'),
|
|
'apps/server/node_modules/pkg/index.js must be excluded',
|
|
);
|
|
assert.ok(matchesDockerignore(patterns, '.npmrc'), 'the root .npmrc must be excluded too');
|
|
assert.ok(matchesDockerignore(patterns, '.env.t08-probe'), 'the probe env file must be excluded');
|
|
|
|
// Source files and committed manifests are kept.
|
|
assert.ok(!matchesDockerignore(patterns, 'apps/server/src/index.ts'), 'source files must not be excluded');
|
|
assert.ok(!matchesDockerignore(patterns, 'apps/server/package.json'), 'committed manifests must not be excluded');
|
|
assert.ok(!matchesDockerignore(patterns, 'package.json'), 'the root manifest must not be excluded');
|
|
|
|
// Docker semantics (moby/patternmatcher), NOT gitignore basename semantics:
|
|
// a slash-less pattern is anchored to the context root, so the bare forms
|
|
// exclude nothing under apps/server/… — this is exactly why the committed
|
|
// patterns are `**/`-prefixed.
|
|
assert.ok(
|
|
!matchesDockerignore(dockerignorePatterns('.npmrc'), 'apps/server/.npmrc'),
|
|
'bare .npmrc must not match a nested .npmrc (Docker anchors it to the root)',
|
|
);
|
|
assert.ok(
|
|
!matchesDockerignore(dockerignorePatterns('.env'), 'apps/server/.env'),
|
|
'bare .env must not match a nested .env (Docker anchors it to the root)',
|
|
);
|
|
assert.ok(
|
|
!matchesDockerignore(dockerignorePatterns('*.key'), 'config/server.key'),
|
|
'bare *.key must not match a nested key file (Docker anchors it to the root)',
|
|
);
|
|
assert.ok(
|
|
!matchesDockerignore(dockerignorePatterns('secrets'), 'apps/server/secrets/creds.txt'),
|
|
'bare secrets must not prune a nested secrets/ dir (Docker anchors it to the root)',
|
|
);
|
|
|
|
// Parent-directory propagation: a pattern that matches a directory prunes
|
|
// everything under it — at the root (bare form) and at any depth (**/ form).
|
|
assert.ok(
|
|
matchesDockerignore(dockerignorePatterns('secrets'), 'secrets/credentials.txt'),
|
|
'a root-level secrets/ dir must be pruned by the bare pattern',
|
|
);
|
|
assert.ok(
|
|
matchesDockerignore(dockerignorePatterns('**/secrets'), 'apps/server/secrets/credentials.txt'),
|
|
'a nested secrets/ dir must be pruned by the **/-prefixed pattern',
|
|
);
|
|
assert.ok(
|
|
matchesDockerignore(dockerignorePatterns('**/.npmrc'), '.npmrc'),
|
|
'**/.npmrc must also match the root form',
|
|
);
|
|
});
|