Repository navigation
discovery(test/security): SecurityPolicy.dangerous_patterns refactor broke 2 tests in secure_command_executor_test #7147
Description
Discovery during PR (#6987 part 1)
PR fixing the src.* mock paths in secure_command_executor_test.py (#6987 part 1) surfaced 2 pre-existing test failures unrelated to the src.* bug.
Failing tests
1. TestSecurityPolicy.test_security_policy_initialization
autobot-backend/secure_command_executor_test.py:33: in test_security_policy_initialization
assert len(policy.dangerous_patterns) > 0
E AttributeError: 'SecurityPolicy' object has no attribute 'dangerous_patterns'
SecurityPolicy no longer exposes dangerous_patterns. The patterns have been moved or restructured. The test asserts against a deleted-or-renamed attribute.
2. TestSecureCommandExecutor.test_check_dangerous_patterns
autobot-backend/secure_command_executor_test.py:100: in test_check_dangerous_patterns
assert any("rm\\s+-rf\\s+/" in pattern for pattern in patterns)
E assert False
The actual patterns list no longer contains the regex rm\s+-rf\s+/ — the dangerous-pattern set has been refactored.
Why this matters
Both tests have been failing silently in CI (or being skipped — needs verification) since the SecurityPolicy refactor. With the src.* mock paths now fixed (PR for #6987 part 1), these tests are visible failures.
This is one of the patterns #6987 anticipates: "tests passing on stale-mock-luck now fail (real regressions to address)".
Acceptance criteria
- Determine the actual current
SecurityPolicyAPI anddangerous_patternslocation - Either:
- Fix the tests to assert against the current API (preferred — they document the security invariant the patterns enforce)
- Or retire the tests with rationale if the security invariant moved elsewhere and is covered by other tests
- Verify the security invariant the tests originally documented is still enforced somewhere
Related
- bug(tests): 48 mock paths target nonexistent 'src.*' package — patches silently no-op #6987 — the broken src.* mocks parent issue
- The src.* fix in part 1 PR — making this rot visible
Activity
fix(test/security): update 2 tests for SecurityPolicy refactor (#7147)
fix(test/security): update 2 tests for SecurityPolicy refactor (#7147) (
github-actions commentedon May 7, 2026
PR #7199 (merged to
Dev_new_gui) references this issue with a close keyword.If this issue is fully resolved, close it manually. If work remains, no action is needed.
mrveiss commentedon May 7, 2026
✅ Closed — both broken tests fixed.
Fix commit: `f34dc161f` → squash-merged via PR #7199
Acceptance Criteria:
Test result: `pytest -k 'test_security_policy_initialization or test_check_dangerous_patterns'` → 2/2 pass.
Wiring verified: Both tests now exercise the canonical `security.command_patterns` module which is the SSOT for dangerous patterns post-#765.
Discovery issues filed: none — both root causes documented inline in test comments referencing #765.
feat(tools/lint): pre-commit hook flagging patch("src.*") mock paths (c…
feat(tools/lint): pre-commit hook flagging patch("src.*") mock paths (c…
fix(security): repair three real defects and repoint the stale securi…
fix(security): repair three real defects and repoint the stale securi…