viktoruj_obsidian-cloud-kms/SECURITY_TESTING.md

Security Testing Documentation

Overview

This document describes the security testing approach for the obsidian-cloud-kms-encryption plugin. It covers what is tested, how, and what remains untested.

Test Categories

1. Unit Tests (357 tests)

Automated tests covering individual components:

Component	Tests	What's verified
SecureBuffer	8	Zero-fill on release, access-after-release throws, double-release safe
BufferRegistry	6	Tracking, force-release-all, cleanup on unload
WebCrypto (AES-256-GCM)	12	Encrypt/decrypt round-trip, auth tag verification, nonce uniqueness
CryptoEngine	15	Envelope encryption flow, DEK zeroing, error propagation
OCKE Parser	24	Magic bytes, version check, field validation, truncation detection, trailing bytes
OCKE Serializer	18	Round-trip, field constraints, big-endian encoding
Inline Codec	12	Base64 encode/decode, fence detection, whitespace handling
AWS KMS Adapter	14	Timeout, credential errors, authorization errors, region extraction
Provider Dispatcher	10	Registration, duplicate rejection, interface validation
ARN Validator	16	Format validation, edge cases, region extraction
Frontmatter Splitter	18	YAML detection, body extraction, edge cases
Suffix Matcher	25	Case-sensitive matching, empty inputs
Settings Tab	9	Default values, persistence, validation
Notices	6	Error category display
Structured Logger	8	JSON output, sanitization
Sanitizer	12	Sensitive field stripping

2. Fuzz Testing (CI workflow)

Weekly automated fuzzing:

• Random byte sequences fed to OCKE parser (crash detection)
• Property-based tests via fast-check (when property tests exist)
• Ensures no unhandled exceptions on malformed input

3. Static Analysis (CodeQL)

Automated SAST on every push:

• SQL injection patterns
• Path traversal
• Hardcoded secrets
• Insecure crypto usage
• Prototype pollution
• Command injection

4. Dependency Scanning

• npm audit on every CI run (high + critical)
• Dependabot weekly updates
• SBOM generated per release

Security Properties Verified

Property	How verified	Status
Encrypt/decrypt round-trip	Unit tests + property tests	✅
Auth tag detects tampering	Unit test (flip byte → error)	✅
DEK zeroed after use	Unit test (buffer state check)	✅
No plaintext in serialized output	Unit test (substring search)	✅
Parser rejects malformed input	Unit tests (24 cases)	✅
Nonce never reused	Unit test (uniqueness check)	✅
Credentials not stored	Code review + no localStorage usage	✅
No sensitive data in logs	Sanitizer unit tests	✅
Timeout enforcement	Unit test (AbortController)	✅
Graceful degradation on KMS failure	Unit test (error handling)	✅

What Is NOT Tested

Area	Reason	Risk
Actual KMS integration	Requires live AWS account	Tested manually
Obsidian API compatibility	Requires running Obsidian	Tested manually
Memory leak detection	No automated tooling for JS heap	Low (SecureBuffer mitigates)
Side-channel attacks	Out of scope for JS runtime	Accept
Concurrent access	Obsidian is single-threaded	N/A
Cross-plugin interference	Cannot simulate in unit tests	Documented limitation

Running Security Tests

# Full test suite
npm test

# Only security-relevant tests
npx vitest --run tests/unit/core/
npx vitest --run tests/unit/format/
npx vitest --run tests/unit/providers/

# Lint for security patterns
npx eslint src/ --rule '{"no-eval": "error", "no-implied-eval": "error"}'

# Dependency audit
npm audit --audit-level=high

# Type safety (catches many security bugs)
npx tsc --noEmit

Verification Checklist (for reviewers)

• No eval(), Function(), or new Function() in source
• No console.log with sensitive data in production code
• No credentials in settings or localStorage
• All crypto uses WebCrypto API (no custom implementations)
• DEK buffers zeroed in all code paths (success + error)
• No plaintext written to any file (adapter patch intercepts)
• Error messages don't contain plaintext or DEK material
• All KMS calls have timeout (AbortController)
• Blob URLs revoked on plugin unload