Ensure markdown README gets sanitised

tests/test_markdown_sanitize.py

@@ -0,0 +1,87 @@
+"""Security regression: harvested values embedded in the generated Ansible
+``README.md`` must be neutralised so an attacker-influenceable host name, file
+path, or note cannot inject Markdown structure (a forged heading, deceptive
+link/command block) or a terminal escape sequence into the documentation.
+
+Harvested values are not executed by Ansible, but the README is the
+human-readable summary an operator reads before applying a manifest, so a value
+that breaks out of its surrounding list item / inline code span and forges
+document structure is misleading and must be prevented.
+"""
+
+from __future__ import annotations
+
+from enroll.cm import (
+    markdown_list,
+    sanitize_markdown_text,
+    snapshot_excluded_lines,
+    snapshot_note_lines,
+)
+
+
+def test_sanitize_collapses_newlines_and_strips_controls():
+    # A newline would let a value break out of its Markdown line; a backtick
+    # would close an inline code span; ESC/BEL are terminal escape vectors.
+    payload = "host`\n## Injected\n[x](http://evil)\n`y\x1b[31mRED\x07\ttab"
+    out = sanitize_markdown_text(payload)
+
+    assert "\n" not in out and "\r" not in out
+    assert "`" not in out  # backticks replaced so a code span cannot be closed
+    assert "\x1b" not in out and "\x07" not in out  # control bytes stripped
+    # The visible text is preserved on a single line (heading marker is now inert
+    # because it no longer starts a line).
+    assert "## Injected" in out
+    assert "http://evil" in out
+
+
+def test_sanitize_is_idempotent_and_handles_non_str():
+    once = sanitize_markdown_text("a\nb")
+    assert sanitize_markdown_text(once) == once
+    assert sanitize_markdown_text(1234) == "1234"
+    assert sanitize_markdown_text(None) == "None"
+
+
+def test_markdown_list_does_not_gain_extra_lines_from_payload():
+    # Even if a pre-composed line still contained a newline, markdown_list must
+    # not emit more bullets than it was given.
+    out = markdown_list(["clean line", "two\nlines should be one bullet"])
+    # Two input items -> at most two leading "- " bullets.
+    assert out.count("\n- ") <= 1
+
+
+def test_snapshot_note_lines_neutralises_injected_note():
+    roles = {
+        "etc_custom": {
+            "role_name": "etc_custom",
+            "notes": ["benign`\n## PWNED\n- fake bullet\x1b[5m"],
+        }
+    }
+    lines = snapshot_note_lines(roles)
+    assert len(lines) == 1
+    line = lines[0]
+    # The role name code span is intact; the payload is folded onto one line
+    # with backticks and control bytes removed.
+    assert line.startswith("`etc_custom`: ")
+    assert "\n" not in line
+    assert "\x1b" not in line
+    # Only the (structural) backticks around the role name remain -- the
+    # payload's backtick was neutralised.
+    assert line.count("`") == 2
+
+
+def test_snapshot_excluded_lines_neutralises_injected_path():
+    roles = {
+        "etc_custom": {
+            "role_name": "etc_custom",
+            "excluded": [
+                {"path": "/etc/`\n## fake-heading\nx", "reason": "denied_path"}
+            ],
+        }
+    }
+    lines = snapshot_excluded_lines(roles)
+    assert len(lines) == 1
+    line = lines[0]
+    assert "\n" not in line
+    assert line.startswith("`etc_custom`: ")
+    assert line.count("`") == 2  # only the structural role-name span
+    assert "(denied_path)" in line