Viacheslav Klimov
2 weeks ago
committed by
GitHub
GitHub
18 changed files with 287 additions and 48 deletions
@ -0,0 +1,73 @@ |
|||
/** |
|||
* Copyright © 2016-2026 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.msa.security; |
|||
|
|||
import com.fasterxml.jackson.databind.JsonNode; |
|||
import org.testng.annotations.AfterClass; |
|||
import org.testng.annotations.BeforeClass; |
|||
import org.testng.annotations.Test; |
|||
import org.thingsboard.server.msa.AbstractContainerTest; |
|||
|
|||
import static org.assertj.core.api.Assertions.assertThat; |
|||
|
|||
public class JsExecutorSandboxIsolationTest extends AbstractContainerTest { |
|||
|
|||
@BeforeClass |
|||
public void beforeClass() { |
|||
testRestClient.login("tenant@thingsboard.org", "tenant"); |
|||
} |
|||
|
|||
@AfterClass |
|||
public void afterClass() { |
|||
testRestClient.resetToken(); |
|||
} |
|||
|
|||
/** |
|||
* Black-box regression for JVN#16937365: a tenant admin must not be able |
|||
* to escape the tb-js-executor sandbox via the host-realm prototype chain |
|||
* exposed through the script's `args` argument. Runs against the live |
|||
* docker-compose deployment, which uses script.use_sandbox=true and |
|||
* JS_EVALUATOR=remote (Kafka -> tb-js-executor). |
|||
*/ |
|||
@Test |
|||
public void testRuleChainScriptCannotReachHostProcess() { |
|||
JsonNode response = testRestClient.testRuleChainScript(""" |
|||
{ |
|||
"script": "var F = args.constructor.constructor; var p = F('return process')(); return { reachedHost: !!(p && p.mainModule) };", |
|||
"scriptType": "update", |
|||
"argNames": ["msg", "metadata", "msgType"], |
|||
"msg": "{}", |
|||
"metadata": {}, |
|||
"msgType": "POST_TELEMETRY_REQUEST" |
|||
} |
|||
"""); |
|||
|
|||
// The sandboxed run must reject the escape attempt: the host `process`
|
|||
// global is not defined inside the sandbox realm, so executing the
|
|||
// synthesized function `F("return process")` throws.
|
|||
assertThat(response.has("error")).isTrue(); |
|||
String error = response.get("error").asText(); |
|||
assertThat(error) |
|||
.as("sandbox must block host-realm reach via args.constructor.constructor; full error: %s", error) |
|||
.contains("process is not defined"); |
|||
|
|||
// Defense in depth: even if the script somehow returned, output must
|
|||
// not indicate that the host process was reached.
|
|||
if (response.hasNonNull("output")) { |
|||
assertThat(response.get("output").asText()).doesNotContain("\"reachedHost\":true"); |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,83 @@ |
|||
///
|
|||
/// Copyright © 2016-2026 The Thingsboard Authors
|
|||
///
|
|||
/// Licensed under the Apache License, Version 2.0 (the "License");
|
|||
/// you may not use this file except in compliance with the License.
|
|||
/// You may obtain a copy of the License at
|
|||
///
|
|||
/// http://www.apache.org/licenses/LICENSE-2.0
|
|||
///
|
|||
/// Unless required by applicable law or agreed to in writing, software
|
|||
/// distributed under the License is distributed on an "AS IS" BASIS,
|
|||
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|||
/// See the License for the specific language governing permissions and
|
|||
/// limitations under the License.
|
|||
///
|
|||
|
|||
import { describe, test } from 'node:test'; |
|||
import assert from 'node:assert/strict'; |
|||
import { JsExecutor } from '../api/jsExecutor'; |
|||
|
|||
// describe('js-executor') groups all cases under <testsuite name="js-executor">
|
|||
// in the JUnit XML so they show up under that suite in TeamCity's Tests tab,
|
|||
// alongside thousands of Java tests.
|
|||
describe('js-executor', () => { |
|||
|
|||
test('sandbox isolates args from host realm (JVN#16937365)', async () => { |
|||
const exec = new JsExecutor(true); |
|||
const script = await exec.compileScript(`function(msg, metadata, msgType){
|
|||
var F = args.constructor.constructor; |
|||
var p = F("return process")(); |
|||
return p && p.mainModule ? 'reached-host' : 'isolated'; |
|||
}`);
|
|||
await assert.rejects( |
|||
exec.executeScript(script, ['{}', '{}', 'POST_TELEMETRY_REQUEST'], 5000), |
|||
/process is not defined/, |
|||
'host process must not be reachable from inside the sandbox', |
|||
); |
|||
}); |
|||
|
|||
test('sandbox passes string args through unchanged', async () => { |
|||
const exec = new JsExecutor(true); |
|||
const script = await exec.compileScript(`function(msg, metadata, msgType){
|
|||
return { msgIsString: typeof msg === 'string', count: args.length, first: args[0] }; |
|||
}`);
|
|||
const out = await exec.executeScript(script, ['hello', '{}', 'X'], 5000); |
|||
// Field-by-field: the returned object is owned by the sandbox realm, so
|
|||
// its prototype is not the host Object.prototype and deepStrictEqual would
|
|||
// reject it on prototype mismatch even when the values match.
|
|||
assert.equal(out.msgIsString, true); |
|||
assert.equal(out.count, 3); |
|||
assert.equal(out.first, 'hello'); |
|||
}); |
|||
|
|||
// The use_sandbox=false path is intentionally non-isolating: scripts compile
|
|||
// and run in the host realm via vm.compileFunction. The two tests below codify
|
|||
// that documented contract so any future behavior change shows up as a test
|
|||
// failure and forces a deliberate update of the docs and threat model.
|
|||
|
|||
test('non-sandbox path does not isolate from host realm (documented contract)', async () => { |
|||
const exec = new JsExecutor(false); |
|||
const script = await exec.compileScript(`function(msg, metadata, msgType){
|
|||
// Non-destructive host-reach probe: typeof process.platform is 'string'
|
|||
// only if the host process object is reachable.
|
|||
var F = args.constructor.constructor; |
|||
return F('return typeof process.platform')(); |
|||
}`);
|
|||
const out = await exec.executeScript(script, ['{}', '{}', 'X']); |
|||
assert.equal(out, 'string', |
|||
'use_sandbox=false is documented as non-isolating; if this fails, the path was changed and docs/threat model must be updated'); |
|||
}); |
|||
|
|||
test('non-sandbox path passes string args through unchanged', async () => { |
|||
const exec = new JsExecutor(false); |
|||
const script = await exec.compileScript(`function(msg, metadata, msgType){
|
|||
return { msgIsString: typeof msg === 'string', count: args.length, first: args[0] }; |
|||
}`);
|
|||
const out = await exec.executeScript(script, ['hello', '{}', 'X']); |
|||
assert.equal(out.msgIsString, true); |
|||
assert.equal(out.count, 3); |
|||
assert.equal(out.first, 'hello'); |
|||
}); |
|||
|
|||
}); // describe('js-executor')
|
|||
Loading…
Reference in new issue