brent.edwards
e8aa5ac268
CI / lint (pull_request) Successful in 15s
CI / typecheck (pull_request) Successful in 28s
CI / security (pull_request) Successful in 21s
CI / quality (pull_request) Successful in 15s
CI / integration_tests (pull_request) Failing after 6m25s
CI / build (pull_request) Successful in 15s
CI / unit_tests (pull_request) Successful in 6m52s
CI / docker (pull_request) Successful in 9s
CI / coverage (pull_request) Successful in 5m5s
- Restore session.env["PATH"] in integration_tests nox session to ensure
Run Process uses venv Python instead of system Python
- Convert bare Resource references to ${CURDIR}/ absolute paths across
30 robot files to fix CI resolution failures
- Add timeout=30s to all Run Process calls in rxpy_route_validation.robot
to prevent hanging tests
- Tag 2 rxpy tests as slow (require running actors unavailable on CI)
- Fix LangGraph test to use correct config file (LANGGRAPH_CONFIG)
- All 204 tests pass (4 excluded: 2 slow + 2 discovery)
54 lines
2.8 KiB
Plaintext
54 lines
2.8 KiB
Plaintext
*** Settings ***
|
|
Documentation Integration tests for SEC1 security hardening: eval()/exec() removal
|
|
... from stream_router.py, named operation and transform registries.
|
|
... Covers commit 548a09f stage SEC1.1-SEC1.3.
|
|
Resource ${CURDIR}/common.resource
|
|
Suite Setup Setup Test Environment
|
|
Suite Teardown Cleanup Test Environment
|
|
|
|
*** Variables ***
|
|
${HELPER_SCRIPT} robot/helper_security_eval.py
|
|
|
|
*** Test Cases ***
|
|
Named Operations Execute Correctly
|
|
[Documentation] Verify built-in named operations (uppercase, strip, lowercase) work
|
|
[Tags] security stream operations
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} named-operations cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} named-operations-ok
|
|
|
|
Code Blocks Are Rejected With StreamRoutingError
|
|
[Documentation] Verify code blocks with arbitrary Python are rejected (no eval/exec)
|
|
[Tags] security stream injection
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} code-blocks-rejected cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} code-blocks-rejected-ok
|
|
|
|
Custom Operation Registration And Execution
|
|
[Documentation] Verify custom operations can be registered and executed safely
|
|
[Tags] security stream registration
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} custom-operation cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} custom-operation-ok
|
|
|
|
Unregistered Transform Expression Rejected
|
|
[Documentation] Verify unregistered lambda/fn transform expressions are rejected
|
|
[Tags] security stream transform
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} unregistered-transform cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} unregistered-transform-rejected-ok
|
|
|
|
Registered Transform Works After Registration
|
|
[Documentation] Verify named transforms can be registered and execute correctly
|
|
[Tags] security stream transform registration
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} registered-transform cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} registered-transform-ok
|
|
|
|
Identity Is Default Operation
|
|
[Documentation] Verify identity operation is default when none specified
|
|
[Tags] security stream identity
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} identity-default cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} identity-default-ok
|