test/security-c3-baseline-messaging.test.js (2)

107-121: Add assertion messages for content checks.

The content assertions on lines 111-112 and 119-120 lack descriptive messages. If these fail, the error won't explain what was missing.

♻️ Add descriptive assertion messages

   it("telegram.yaml preset exists and contains api.telegram.org", () => {
     const presetPath = path.join(PRESETS_DIR, "telegram.yaml");
     assert.ok(fs.existsSync(presetPath), "telegram.yaml preset must exist");
     const content = fs.readFileSync(presetPath, "utf-8");
-    assert.ok(content.includes("api.telegram.org"));
-    assert.ok(content.includes("network_policies:"));
+    assert.ok(content.includes("api.telegram.org"), "telegram.yaml must include api.telegram.org");
+    assert.ok(content.includes("network_policies:"), "telegram.yaml must include network_policies:");
   });

   it("discord.yaml preset exists and contains discord.com", () => {
     const presetPath = path.join(PRESETS_DIR, "discord.yaml");
     assert.ok(fs.existsSync(presetPath), "discord.yaml preset must exist");
     const content = fs.readFileSync(presetPath, "utf-8");
-    assert.ok(content.includes("discord.com"));
-    assert.ok(content.includes("network_policies:"));
+    assert.ok(content.includes("discord.com"), "discord.yaml must include discord.com");
+    assert.ok(content.includes("network_policies:"), "discord.yaml must include network_policies:");
   });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/security-c3-baseline-messaging.test.js` around lines 107 - 121, The two
content assertions inside the tests "telegram.yaml preset exists and contains
api.telegram.org" and "discord.yaml preset exists and contains discord.com" are
missing descriptive messages; update the assert.ok(content.includes(...)) calls
for both telegram and discord to include a third argument message that states
which substring was expected and which preset file (use PRESETS_DIR/presetPath
and the expected token like "api.telegram.org" or "discord.com") so failures
clearly report the missing content for content and network_policies checks.

---

61-100: YAML parsing is fragile but acceptable for this security invariant.

The hand-rolled YAML parsing assumes specific indentation (2-space) and structure. This works for the known openclaw-sandbox.yaml format.

For improved robustness, consider using a proper YAML parser (e.g., js-yaml) to avoid false positives/negatives if the file format evolves.

♻️ Optional: Use a YAML parser for more robust validation

// At top of file
const yaml = require("js-yaml");

// In test
it("no baseline network_policies block lacks a binaries: restriction", () => {
  const content = fs.readFileSync(BASELINE, "utf-8");
  const doc = yaml.load(content);
  const policies = doc.network_policies || {};
  
  const violators = Object.entries(policies)
    .filter(([_, v]) => !v.binaries || v.binaries.length === 0)
    .map(([name]) => name);
  
  assert.deepEqual(violators, [], 
    `Baseline blocks without binaries: restriction: ${violators.join(", ")}`);
});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/security-c3-baseline-messaging.test.js` around lines 61 - 100, The
current hand-rolled parsing (variables inNetworkPolicies, currentBlock, blocks,
violators reading fs.readFileSync(BASELINE)) is fragile; replace it by parsing
the YAML with a real parser (require("js-yaml") and yaml.load(content)) and then
read doc.network_policies to build the violators list (checking each policy's
binaries property). Update the test's assertion to use the violators derived
from Object.entries(doc.network_policies) (or {} if missing) so names and counts
come from the parsed structure rather than line-based heuristics, but keep the
same failure message formatting if desired.

test/security-c3-baseline-messaging.test.js (2)

115-121: Discord preset check is a bit too narrow for regression coverage.

Line 119 only validates discord.com. To protect preset functionality, also assert gateway.discord.gg and cdn.discordapp.com are present in discord.yaml.

✅ Suggested assertion additions

   it("discord.yaml preset exists and contains discord.com", () => {
     const presetPath = path.join(PRESETS_DIR, "discord.yaml");
     assert.ok(fs.existsSync(presetPath), "discord.yaml preset must exist");
     const content = fs.readFileSync(presetPath, "utf-8");
     assert.ok(content.includes("discord.com"), "discord.yaml must include discord.com");
+    assert.ok(content.includes("gateway.discord.gg"), "discord.yaml must include gateway.discord.gg");
+    assert.ok(content.includes("cdn.discordapp.com"), "discord.yaml must include cdn.discordapp.com");
     assert.ok(content.includes("network_policies:"), "discord.yaml must include network_policies:");
   });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/security-c3-baseline-messaging.test.js` around lines 115 - 121, Update
the Discord preset test in test/security-c3-baseline-messaging.test.js (the it
block titled "discord.yaml preset exists and contains discord.com") to
strengthen assertions: after reading the file into the content variable
(presetPath, content, PRESETS_DIR), add assertions using assert.ok to verify
that content.includes("gateway.discord.gg") and
content.includes("cdn.discordapp.com") in addition to the existing discord.com
and network_policies checks so the preset covers gateway and CDN hosts too.

---

29-59: Consider parameterizing host-absence assertions to reduce duplication.

These tests repeat the same read/assert pattern four times. A small table-driven loop would keep this easier to extend and maintain.

♻️ Suggested refactor

 describe("C-3: baseline policy must not contain messaging exfiltration channels", () => {
-  it("api.telegram.org does not appear in baseline YAML", () => {
-    const yaml = fs.readFileSync(BASELINE, "utf-8");
-    assert.ok(
-      !yaml.includes("api.telegram.org"),
-      "api.telegram.org must not appear in baseline — use the telegram preset instead",
-    );
-  });
-
-  it("discord.com does not appear in baseline YAML", () => {
-    const yaml = fs.readFileSync(BASELINE, "utf-8");
-    assert.ok(
-      !yaml.includes("discord.com"),
-      "discord.com must not appear in baseline — use the discord preset instead",
-    );
-  });
-
-  it("gateway.discord.gg does not appear in baseline YAML", () => {
-    const yaml = fs.readFileSync(BASELINE, "utf-8");
-    assert.ok(
-      !yaml.includes("gateway.discord.gg"),
-      "gateway.discord.gg must not appear in baseline — use the discord preset instead",
-    );
-  });
-
-  it("cdn.discordapp.com does not appear in baseline YAML", () => {
-    const yaml = fs.readFileSync(BASELINE, "utf-8");
-    assert.ok(
-      !yaml.includes("cdn.discordapp.com"),
-      "cdn.discordapp.com must not appear in baseline — use the discord preset instead",
-    );
-  });
+  const yaml = fs.readFileSync(BASELINE, "utf-8");
+  const forbiddenHosts = [
+    ["api.telegram.org", "telegram preset"],
+    ["discord.com", "discord preset"],
+    ["gateway.discord.gg", "discord preset"],
+    ["cdn.discordapp.com", "discord preset"],
+  ];
+
+  for (const [host, preset] of forbiddenHosts) {
+    it(`${host} does not appear in baseline YAML`, () => {
+      assert.ok(
+        !yaml.includes(host),
+        `${host} must not appear in baseline — use the ${preset} instead`,
+      );
+    });
+  }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/security-c3-baseline-messaging.test.js` around lines 29 - 59, Replace
the four nearly identical tests that read BASELINE with a parameterized
table-driven test: read the file once using fs.readFileSync(BASELINE, "utf-8")
into a variable (instead of repeating in each it block) and iterate over an
array of host strings (e.g.,
["api.telegram.org","discord.com","gateway.discord.gg","cdn.discordapp.com"]) to
create assertions (assert.ok(!yaml.includes(host), ...)). Update the existing it
blocks to a single test or a loop that calls assert.ok for each host and reuse
the same error message pattern; reference the existing BASELINE constant and the
current use of fs.readFileSync/assert.ok to locate where to change.