Lucas WintherandClaude Opus 5.5
0da35ec6f8
The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP. Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options. Co-Authored-By: Claude Opus 5.5 <[email protected]>
53 lines
2.7 KiB
TypeScript
53 lines
2.7 KiB
TypeScript
// Browser harness for the headless-Chrome tests: the real runner and the real LessonView, bundled for the browser.
|
|
import { createRoot } from "react-dom/client";
|
|
import { createBrowserRunner } from "../../src/web/runner/runner";
|
|
import { WORKER_SOURCE } from "../../src/web/runner/worker-source";
|
|
import { LessonView } from "../../src/web/lesson/LessonView";
|
|
import type { LessonPayload } from "../../src/shared/types";
|
|
|
|
declare global {
|
|
interface Window {
|
|
stcRun(code: string, tests: string, timeoutMs: number): Promise<unknown>;
|
|
/** Negative control only: the old design, a same-origin blob worker in the page. */
|
|
stcRunPlain(code: string, tests: string, timeoutMs: number): Promise<unknown>;
|
|
stcRenderLesson(markdown: string, hintBody: string): Promise<string>;
|
|
/** Sets unsanitized HTML with innerHTML (bypasses the sanitizer) to test the CSP layer on its own. */
|
|
stcRawHtml(html: string): Promise<number>;
|
|
stcReady: boolean;
|
|
}
|
|
}
|
|
|
|
window.stcRun = (code, tests, timeoutMs) => createBrowserRunner("js").run(code, tests, timeoutMs);
|
|
window.stcRunPlain = (code, tests, timeoutMs) => createBrowserRunner("js", {
|
|
createWorker: () => new Worker(URL.createObjectURL(new Blob([WORKER_SOURCE], { type: "text/javascript" })), { type: "module" }),
|
|
}).run(code, tests, timeoutMs);
|
|
|
|
window.stcRenderLesson = async (markdown, hintBody) => {
|
|
const lesson: LessonPayload = {
|
|
courseId: "c", courseTitle: "C", lesson: { id: "x", title: "Exploit", type: "exercise", minutes: null },
|
|
module: { id: "m", title: "M", index: 0 }, locked: false, markdown, baseFile: "course/x.md", trackMarkdown: {}, tracks: [],
|
|
video: null, transcript: null, hints: [{ label: "nudge", body: hintBody }], decks: [], code: null, attachments: [], browser: null,
|
|
localCommand: null, prev: null, next: null, lessonFiles: {},
|
|
};
|
|
const el = document.getElementById("root")!;
|
|
createRoot(el).render(<LessonView lesson={lesson} preview />);
|
|
await new Promise((r) => setTimeout(r, 300));
|
|
// Open every fold so nested content is live in the DOM too.
|
|
for (const d of document.querySelectorAll("details")) d.open = true;
|
|
await new Promise((r) => setTimeout(r, 500));
|
|
return el.innerHTML;
|
|
};
|
|
|
|
window.stcRawHtml = async (html) => {
|
|
let violations = 0;
|
|
document.addEventListener("securitypolicyviolation", () => { violations++; });
|
|
const el = document.createElement("div");
|
|
el.innerHTML = html;
|
|
document.body.append(el);
|
|
for (const a of el.querySelectorAll("a, summary, img")) { try { a.dispatchEvent(new MouseEvent("click", { bubbles: true, cancelable: true })); } catch (_) { /* ignore */ } }
|
|
await new Promise((r) => setTimeout(r, 600));
|
|
return violations;
|
|
};
|
|
|
|
window.stcReady = true;
|