54 lines
2.2 KiB
Python
54 lines
2.2 KiB
Python
"""synapse/curry_core.py (vendored) + synapse/curry_store.py (NexusOS's preload).
|
|
|
|
Two concerns: the vendor sync didn't silently drop the sandbox fix from
|
|
https://github.com/Athena-Pro/Curry/pull/4, and curry_store gives NexusOS a
|
|
live instance for the registered chat tools.
|
|
"""
|
|
import pytest
|
|
|
|
from synapse.curry_core import Curry, TypeSignature
|
|
from synapse import curry_store
|
|
|
|
|
|
def test_curry_store_is_preloaded_and_open():
|
|
# curry_store.curry_db is a module-level singleton constructed at import
|
|
# time (mirrors synapse.memory.store.store / synapse.playbooks.store.playbook_store)
|
|
# - by the time this test runs, it has already opened its database file.
|
|
assert isinstance(curry_store.curry_db, Curry)
|
|
assert curry_store.curry_db.conn.execute("SELECT 1").fetchone()[0] == 1
|
|
|
|
|
|
def test_curry_db_path_matches_nexus_config(tmp_path, monkeypatch):
|
|
from synapse import nexus_config
|
|
assert str(curry_store.curry_db.db_path) == str(nexus_config.CURRY_DB)
|
|
|
|
|
|
def test_vendored_sandbox_fix_rejects_format_dunder_escape(tmp_path):
|
|
# Regression test for the vendored fix: a body that hides dunder-attribute
|
|
# traversal inside a str.format() field spec must still be rejected at
|
|
# declare time, not just the literal '.__class__' form. If a future
|
|
# re-vendor from upstream drops the fix, this is what catches it.
|
|
db = Curry(str(tmp_path / "sandbox_check.db"))
|
|
db.declare_function("helper", 1, "1")
|
|
|
|
exploit = "'{0.__globals__}'.format(helper)"
|
|
with pytest.raises(ValueError, match="format"):
|
|
db.declare_function("evil", 1, exploit, function_bindings={"helper": 1})
|
|
|
|
# the original, always-caught dunder-attribute form stays blocked too
|
|
with pytest.raises(ValueError):
|
|
db.declare_function("evil2", 1, "x.__class__", expected_args=["x"])
|
|
|
|
db.close()
|
|
|
|
|
|
def test_vendored_curry_basic_versioning_roundtrip(tmp_path):
|
|
db = Curry(str(tmp_path / "roundtrip.db"))
|
|
db.declare_constant("rate", 1, 0.1, TypeSignature.FLOAT64.value)
|
|
db.declare_function(
|
|
"apply_rate", 1, "amount * (1 + rate)",
|
|
constant_bindings={"rate": 1}, expected_args=["amount"],
|
|
)
|
|
assert db.call_function("apply_rate", 1, {"amount": 100}) == 110.00000000000001
|
|
db.close()
|
GitNexus · part of the Nexus stack