Lucas WintherandClaude Opus 5.5
c7b9e1f98e
C1: lesson HTML goes through a sanitize-html allowlist on the fully rendered output (no on* attributes, no style, no svg/math/iframe/object/embed/form; URLs limited to http(s), mailto, relative and anchors). Raw tags outside the allowlist are escaped as text. The SPA document is served with a CSP (script-src 'self', no inline script) through spaWithCsp in main.ts; contract request §5 asks core to own it. C2: exercises run in <iframe sandbox="allow-scripts"> (opaque origin, no cookies) loaded from /api/learner/runner-frame, whose CSP allows only its own script (by hash) and blob: workers, and connect-src 'none'. postMessage only, both sides check event.source; the timeout removes the frame. The worker stubs now also cover Worker, SharedWorker and caches. I1: learner visibility calls core canView with per-course authorship only, like /api/media (contract request §6). I2: Tab and Shift+Tab move focus; Enter keeps the previous line's indentation. Tests: XSS unit cases, headless-Chrome checks for the exploit lesson and for fetch, import, Cache.add, nested Worker, img, EventSource, WebSocket, XHR and sendBeacon from learner and test code (plus a negative control), visibility on both dialects, SPA and runner-frame CSP headers. Co-Authored-By: Claude Opus 5.5 <[email protected]>
22 lines
446 B
JSON
22 lines
446 B
JSON
{
|
|
"name": "@stc/feature-learner",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"license": "AGPL-3.0-only",
|
|
"dependencies": {
|
|
"@better-auth/sso": "^1.7.14",
|
|
"better-auth": "^1.7.14",
|
|
"marked": "^18.1.2",
|
|
"pdfjs-dist": "^6.4.299",
|
|
"sanitize-html": "^2"
|
|
},
|
|
"exports": {
|
|
".": "./src/index.ts",
|
|
"./web": "./web/src/index.ts"
|
|
},
|
|
"devDependencies": {
|
|
"@types/sanitize-html": "^2.16.2"
|
|
}
|
|
}
|