lucasw89/STCourses
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(learner): review round 1: sanitize-html, sandboxed runner frame, one visibility rule, no Tab capture

Browse Source 
C1: lesson HTML goes through a sanitize-html allowlist on the fully rendered output (no on* attributes, no
style, no svg/math/iframe/object/embed/form; URLs limited to http(s), mailto, relative and anchors). Raw tags
outside the allowlist are escaped as text. The SPA document is served with a CSP (script-src 'self', no inline
script) through spaWithCsp in main.ts; contract request §5 asks core to own it.

C2: exercises run in <iframe sandbox="allow-scripts"> (opaque origin, no cookies) loaded from
/api/learner/runner-frame, whose CSP allows only its own script (by hash) and blob: workers, and connect-src
'none'. postMessage only, both sides check event.source; the timeout removes the frame. The worker stubs now
also cover Worker, SharedWorker and caches.

I1: learner visibility calls core canView with per-course authorship only, like /api/media (contract request §6).
I2: Tab and Shift+Tab move focus; Enter keeps the previous line's indentation.

Tests: XSS unit cases, headless-Chrome checks for the exploit lesson and for fetch, import, Cache.add, nested
Worker, img, EventSource, WebSocket, XHR and sendBeacon from learner and test code (plus a negative control),
visibility on both dialects, SPA and runner-frame CSP headers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Lucas Winther
2026-10-30 05:20:43 +01:00
co-authored by Claude Opus 5.5
parent 061ae7a2d9
commit c7b9e1f98e
22 changed files with 840 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/feature-learner/test/markdown.test.ts
+5 -4
View File
@@ -100,11 +100,12 @@ test("systemic-design hint numbering forms one group", () => {
});
test("raw HTML is reduced to safe tags", () => {
expect(sanitizeHtml('<script>alert(1)</script><kbd>x</kbd><img src=x onerror=alert(1)><details open>')).toBe("&lt;script&gt;alert(1)&lt;/script&gt;<kbd>x</kbd>&lt;img src=x onerror=alert(1)&gt;<details open>");
expect(sanitizeHtml('<script>alert(1)</script><kbd>x</kbd><img src=x onerror=alert(1)><details open>')).toBe('&lt;script&gt;alert(1)&lt;/script&gt;<kbd>x</kbd><img src="x" /><details open></details>');
const html = renderLessonHtml('<div onclick="x()">hi</div>\n\n[x](javascript:alert(1)) <span style="color:red">s</span>', opts);
expect(html).not.toContain("<div");
expect(html).toContain("<div>hi</div>");
expect(html).not.toContain("onclick");
expect(html).not.toContain("javascript:");
expect(html).not.toContain('<span style');
expect(html).not.toContain("style=");
});
test("links and images resolve inside the course", () => {
@@ -114,7 +115,7 @@ test("links and images resolve inside the course", () => {
expect(resolveHref("https://example.com", opts, "link")).toEqual({ url: "https://example.com", external: true });
expect(resolveHref("img/a.png", opts, "image")).toEqual({ url: "/api/media/pure-snake/course/img/a.png", external: false });
const html = renderLessonHtml("![board](img/board.png) and [ext](https://x.org)", opts);
expect(html).toContain('<img src="/api/media/pure-snake/course/img/board.png" alt="board" loading="lazy">');
expect(html).toContain('<img src="/api/media/pure-snake/course/img/board.png" alt="board" loading="lazy" />');
expect(html).toContain('target="_blank" rel="noopener noreferrer"');
});