import assert from 'node:assert/strict';
import test from 'node:test';
import { runBasicFileScan } from './mindspace-scan.mjs';
test('runBasicFileScan passes plain text files', () => {
const result = runBasicFileScan(Buffer.from('hello world'), {
filename: 'note.txt',
mimeType: 'text/plain',
});
assert.equal(result.scanStatus, 'passed');
});
test('runBasicFileScan blocks inline script payloads', () => {
const result = runBasicFileScan(Buffer.from(''), {
filename: 'note.md',
mimeType: 'text/markdown',
});
assert.equal(result.scanStatus, 'blocked');
assert.equal(result.riskLevel, 'high');
});
test('runBasicFileScan warns for sandboxed html with inline script and trusted Chart.js', () => {
const result = runBasicFileScan(
Buffer.from(`
`),
{
filename: 'dashboard.html',
mimeType: 'text/html',
htmlActiveContentPolicy: 'sandbox_warn',
},
);
assert.equal(result.scanStatus, 'warned');
assert.equal(result.riskLevel, 'medium');
assert.deepEqual(result.findings, ['trusted_html_active_content']);
});
test('runBasicFileScan still blocks unsafe html active content in sandbox mode', () => {
const javascriptUrl = runBasicFileScan(Buffer.from('go'), {
filename: 'dashboard.html',
mimeType: 'text/html',
htmlActiveContentPolicy: 'sandbox_warn',
});
assert.equal(javascriptUrl.scanStatus, 'blocked');
assert.deepEqual(javascriptUrl.findings, ['javascript_url']);
const unknownScript = runBasicFileScan(
Buffer.from(''),
{
filename: 'dashboard.html',
mimeType: 'text/html',
htmlActiveContentPolicy: 'sandbox_warn',
},
);
assert.equal(unknownScript.scanStatus, 'blocked');
assert.deepEqual(unknownScript.findings, ['text_active_content']);
});
test('runBasicFileScan blocks suspicious zip compression ratio', () => {
const buffer = Buffer.alloc(64);
buffer.write('PK', 0);
buffer.writeUInt16LE(8, 8);
buffer.writeUInt32LE(10, 18);
buffer.writeUInt32LE(5000, 22);
const result = runBasicFileScan(buffer, {
filename: 'report.docx',
mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
});
assert.equal(result.scanStatus, 'blocked');
});