refactor(siteruntime): M3.3 ValidateTrustModel delegates to shared ScriptAnalysis + compile-surface parity test

2026-06-16 19:37:50 -04:00
parent 14bd25196a
commit 64d6ac7288
6 changed files with 195 additions and 185 deletions
@@ -5,6 +5,16 @@ namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests.Scripts;

 /// <summary>
 /// WP-19: Script Trust Model tests — validates forbidden API detection and compilation.
+///
+/// As of the M3.3 consolidation, <c>ScriptCompilationService.ValidateTrustModel</c>
+/// delegates its forbidden-API verdict to the shared authoritative
+/// <c>ScriptAnalysis.ScriptTrustValidator</c>, which is stricter than SiteRuntime's
+/// original deny-list: ALL of <c>System.Net</c> is forbidden (not just Sockets/Http),
+/// plus reflection gateways, <c>dynamic</c>, <c>Activator</c>,
+/// <c>System.Runtime.InteropServices</c> and <c>Microsoft.Win32</c>. Only
+/// <c>System.Diagnostics.Process</c> is blocked under System.Diagnostics —
+/// <c>Stopwatch</c> stays allowed. The real execution-path compile against
+/// <c>ScriptGlobals</c> / <c>TriggerExpressionGlobals</c> is unchanged.
 /// </summary>
 public class ScriptCompilationServiceTests
 {
@@ -108,4 +118,61 @@ public class ScriptCompilationServiceTests
        Assert.False(result.IsSuccess);
        Assert.NotEmpty(result.Errors);
    }
+
+    // ── M3.3: stricter shared-validator behavior ──
+
+    [Fact]
+    public void ValidateTrustModel_SystemNetDns_Forbidden()
+    {
+        // The shared validator forbids ALL of System.Net — not just Sockets/Http.
+        // System.Net.Dns was allowed under the old SiteRuntime list; now blocked.
+        var violations = _service.ValidateTrustModel(
+            "System.Net.Dns.GetHostName()");
+        Assert.NotEmpty(violations);
+        Assert.Contains(violations, v => v.Contains("System.Net"));
+    }
+
+    [Fact]
+    public void ValidateTrustModel_ReflectionGatewayViaPermittedType_Forbidden()
+    {
+        // typeof(x).Assembly.GetType(...) never spells a forbidden namespace, but
+        // the shared validator rejects the reflection-gateway members regardless of
+        // receiver — this was NOT caught by the old SiteRuntime list.
+        var violations = _service.ValidateTrustModel(
+            "typeof(string).Assembly.GetType(\"System.IO.File\")");
+        Assert.NotEmpty(violations);
+    }
+
+    [Fact]
+    public void ValidateTrustModel_Dynamic_Forbidden()
+    {
+        var violations = _service.ValidateTrustModel("dynamic d = 1; return d;");
+        Assert.NotEmpty(violations);
+    }
+
+    [Fact]
+    public void ValidateTrustModel_Activator_Forbidden()
+    {
+        var violations = _service.ValidateTrustModel(
+            "Activator.CreateInstance(typeof(string))");
+        Assert.NotEmpty(violations);
+    }
+
+    [Fact]
+    public void ValidateTrustModel_InteropServices_Forbidden()
+    {
+        var violations = _service.ValidateTrustModel(
+            "System.Runtime.InteropServices.Marshal.SizeOf<int>()");
+        Assert.NotEmpty(violations);
+    }
+
+    [Fact]
+    public void ValidateTrustModel_Stopwatch_Allowed()
+    {
+        // Only System.Diagnostics.Process is blocked under System.Diagnostics —
+        // Stopwatch stays allowed.
+        var violations = _service.ValidateTrustModel(
+            "var sw = System.Diagnostics.Stopwatch.StartNew(); return sw.ElapsedMilliseconds;");
+        Assert.Empty(violations);
+    }
 }