fix(security): harden template rendering

ISSUES CLOSED: #319
2026-02-22 11:59:33 +00:00
parent 8604bc66b6
commit a7dc917021
9 changed files with 1284 additions and 6 deletions
@@ -0,0 +1,82 @@
+*** Settings ***
+Documentation     Integration tests for secure template rendering
+Resource          common.resource
+Suite Setup       Setup Test Environment
+Suite Teardown    Cleanup Test Environment
+
+*** Test Cases ***
+Safe Template Renders Correctly
+    [Documentation]    Verify a safe template renders with correct output
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    render    Hello {name}    name\=World
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    sec-render-ok: Hello World
+
+Unsafe Template Is Rejected
+    [Documentation]    Verify attribute access template is rejected
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    reject    {obj.__class__}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    sec-reject-ok
+
+Template Validation Passes Clean Template
+    [Documentation]    Verify validation succeeds on a clean template
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    validate    {name} is {role}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    sec-validate-ok
+
+Template Validation Fails Unsafe Template
+    [Documentation]    Verify validation rejects unsafe template
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    validate    {obj.__class__}
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    sec-validate-err
+
+Render Rejects Index Access
+    [Documentation]    Verify index access in template is rejected
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    reject    {items[0]}
+    Should Be Equal As Integers    ${result.rc}    0
+    Should Contain    ${result.stdout}    sec-reject-ok
+
+Reject Command Fails For Safe Template
+    [Documentation]    Verify reject command reports failure for safe template
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    reject    {name}
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    sec-reject-fail
+
+Helper Shows Usage On No Command
+    [Documentation]    Verify helper prints usage when no command given
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    Usage
+
+Helper Rejects Unknown Command
+    [Documentation]    Verify helper rejects an unknown sub-command
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    bogus
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    Unknown command
+
+Render Shows Usage On No Args
+    [Documentation]    Verify render sub-command prints usage with no arguments
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    render
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    Usage
+
+Validate Shows Usage On No Args
+    [Documentation]    Verify validate sub-command prints usage with no arguments
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    validate
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    Usage
+
+Reject Shows Usage On No Args
+    [Documentation]    Verify reject sub-command prints usage with no arguments
+    ${result}=    Run Process    ${PYTHON}    ${WORKSPACE}/robot/helper_security_templates.py
+    ...    reject
+    Should Be Equal As Integers    ${result.rc}    1
+    Should Contain    ${result.stdout}    Usage