fix(learner): review round 1: sanitize-html, sandboxed runner frame, one visibility rule, no Tab capture

C1: lesson HTML goes through a sanitize-html allowlist on the fully rendered output (no on* attributes, no
style, no svg/math/iframe/object/embed/form; URLs limited to http(s), mailto, relative and anchors). Raw tags
outside the allowlist are escaped as text. The SPA document is served with a CSP (script-src 'self', no inline
script) through spaWithCsp in main.ts; contract request §5 asks core to own it.

C2: exercises run in <iframe sandbox="allow-scripts"> (opaque origin, no cookies) loaded from
/api/learner/runner-frame, whose CSP allows only its own script (by hash) and blob: workers, and connect-src
'none'. postMessage only, both sides check event.source; the timeout removes the frame. The worker stubs now
also cover Worker, SharedWorker and caches.

I1: learner visibility calls core canView with per-course authorship only, like /api/media (contract request §6).
I2: Tab and Shift+Tab move focus; Enter keeps the previous line's indentation.

Tests: XSS unit cases, headless-Chrome checks for the exploit lesson and for fetch, import, Cache.add, nested
Worker, img, EventSource, WebSocket, XHR and sendBeacon from learner and test code (plus a negative control),
visibility on both dialects, SPA and runner-frame CSP headers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This commit is contained in:

Lucas Winther

2026-10-30 05:20:43 +01:00

co-authored by

Claude Opus 5.5

parent 061ae7a2d9

commit c7b9e1f98e

22 changed files with 840 additions and 42 deletions

									
										packages/feature-learner/src/index.ts
									
		+1
		
												View File
												
				@@ -1,6 +1,7 @@

				// Server

				export { migrationsDirs, runMigrations } from "./server/migrate";

				export { learnerFeature } from "./server/feature";

				export { spaWithCsp, spaCsp } from "./server/spa";

				// Browser (also available without the server half as "@stc/feature-learner/web")

				export { learnerWeb, LessonView, type LessonViewProps, ensureLearnerStyles } from "./web";

				// Shared JSON shapes