twitter-voice-mcp

import unittest
from unittest.mock import MagicMock
import sys
import os
import tempfile
import shutil

# Add src to path
sys.path.append(os.path.abspath("src"))

class TestPathTraversalRepro(unittest.TestCase):
    @classmethod
    def setUpClass(cls):
        # Mock sys.modules for missing dependencies
        cls.modules_to_restore = {}

        # Mocks needed
        modules_to_mock = [
            "mcp.server.fastmcp",
            "ai_handler",
            "twitter_handler",
            "data_handler",
            "scheduler",
            "dotenv", # Needed
            "google.generativeai", # AI handler might import
            "openai",
            "anthropic"
        ]

        for mod in modules_to_mock:
            if mod in sys.modules:
                cls.modules_to_restore[mod] = sys.modules[mod]
            sys.modules[mod] = MagicMock()

        # Mock FastMCP
        mock_mcp = MagicMock()
        def tool_decorator(*args, **kwargs):
            if len(args) == 1 and callable(args[0]):
                return args[0]
            else:
                def decorator(func):
                    return func
                return decorator
        mock_mcp.tool = tool_decorator
        sys.modules["mcp.server.fastmcp"].FastMCP.return_value = mock_mcp

        # Mock google package to support nested imports
        google_mock = MagicMock()
        google_mock.generativeai = MagicMock()
        sys.modules["google"] = google_mock
        sys.modules["google.generativeai"] = google_mock.generativeai

        # Import server
        import server
        cls.server = server

        # We need to setup a real file system structure for testing symlinks
        cls.temp_dir = tempfile.mkdtemp()
        cls.safe_dir = os.path.join(cls.temp_dir, "data")
        os.makedirs(cls.safe_dir)

        # Override SAFE_DIR in server
        cls.server.SAFE_DIR = cls.safe_dir

    @classmethod
    def tearDownClass(cls):
        shutil.rmtree(cls.temp_dir)
        # Restore modules
        for mod, original in cls.modules_to_restore.items():
            if original:
                sys.modules[mod] = original
            else:
                del sys.modules[mod] # If it wasn't there, remove it

    def test_symlink_traversal(self):
        # Create a secret file OUTSIDE safe_dir
        secret_file = os.path.join(self.temp_dir, "secret.txt")
        with open(secret_file, "w") as f:
            f.write("SECRET_DATA")

        # Create a symlink INSIDE safe_dir pointing to secret_file
        symlink_path = os.path.join(self.safe_dir, "innocent_looking_link.txt")
        try:
            os.symlink(secret_file, symlink_path)
        except OSError:
            print("Symlinks not supported, skipping test")
            return

        # Attempt to access via validate_path
        # If vulnerable, this will succeed and return the path
        # If secure, this should raise ValueError

        try:
            result = self.server.validate_path(symlink_path)
            # If we reach here, it accepted the path.
            print(f"VULNERABILITY CONFIRMED: Allowed access to {result}")
            self.fail("Path traversal vulnerability exists: Symlink was followed.")
        except ValueError as e:
            print(f"SECURE: Blocked access - {e}")

if __name__ == "__main__":
    unittest.main()