first commit

tests/test_v022.py

@@ -0,0 +1,42 @@
+import unittest
+from unittest.mock import patch
+
+from librenet_scanner.privileged_helper import command_for, validate_target
+
+
+class PrivilegedHelperTests(unittest.TestCase):
+    def test_authorize_exposes_no_command(self):
+        self.assertEqual(command_for("authorize", []), [])
+        with self.assertRaises(ValueError):
+            command_for("authorize", ["unexpected"])
+
+    def test_deep_scan_is_fixed_and_validated(self):
+        with patch("librenet_scanner.privileged_helper._trusted_binary", return_value="/usr/bin/nmap"):
+            cmd = command_for("nmap-deep", ["192.168.10.0/24"])
+        self.assertEqual(cmd[0], "/usr/bin/nmap")
+        self.assertIn("-sS", cmd)
+        self.assertIn("-O", cmd)
+        self.assertEqual(cmd[-1], "192.168.10.0/24")
+
+    def test_standard_scan_rejects_option_injection(self):
+        with self.assertRaises(ValueError):
+            command_for("nmap-standard", ["--script", "192.168.1.1"])
+
+    def test_unknown_operation_is_rejected(self):
+        with self.assertRaises(ValueError):
+            command_for("shell", ["/bin/sh"])
+
+    def test_target_limit(self):
+        self.assertEqual(validate_target("192.168.1.42/24"), "192.168.1.0/24")
+        with self.assertRaises(ValueError):
+            validate_target("10.0.0.0/8")
+
+    def test_arp_scan_uses_validated_interface_and_fixed_binary(self):
+        with patch("librenet_scanner.privileged_helper.validate_interface", return_value="enp42s0"), \
+             patch("librenet_scanner.privileged_helper._trusted_binary", return_value="/usr/sbin/arp-scan"):
+            cmd = command_for("arp-scan", ["enp42s0", "192.168.10.0/24"])
+        self.assertEqual(cmd, ["/usr/sbin/arp-scan", "--interface", "enp42s0", "192.168.10.0/24"])
+
+
+if __name__ == "__main__":
+    unittest.main()