Lucas WintherandClaude Opus 5.5
c7b9e1f98e
C1: lesson HTML goes through a sanitize-html allowlist on the fully rendered output (no on* attributes, no style, no svg/math/iframe/object/embed/form; URLs limited to http(s), mailto, relative and anchors). Raw tags outside the allowlist are escaped as text. The SPA document is served with a CSP (script-src 'self', no inline script) through spaWithCsp in main.ts; contract request §5 asks core to own it. C2: exercises run in <iframe sandbox="allow-scripts"> (opaque origin, no cookies) loaded from /api/learner/runner-frame, whose CSP allows only its own script (by hash) and blob: workers, and connect-src 'none'. postMessage only, both sides check event.source; the timeout removes the frame. The worker stubs now also cover Worker, SharedWorker and caches. I1: learner visibility calls core canView with per-course authorship only, like /api/media (contract request §6). I2: Tab and Shift+Tab move focus; Enter keeps the previous line's indentation. Tests: XSS unit cases, headless-Chrome checks for the exploit lesson and for fetch, import, Cache.add, nested Worker, img, EventSource, WebSocket, XHR and sendBeacon from learner and test code (plus a negative control), visibility on both dialects, SPA and runner-frame CSP headers. Co-Authored-By: Claude Opus 5.5 <[email protected]>
28 lines
1.7 KiB
TypeScript
28 lines
1.7 KiB
TypeScript
import { expect } from "bun:test";
|
|
import { forEachDb } from "./helpers";
|
|
import { FIXTURES, makeApp } from "./app";
|
|
import { extraCourses } from "./courses";
|
|
|
|
forEachDb("one visibility rule: the global author role alone does not open a restricted course (I1)", async (db) => {
|
|
const dir = await extraCourses();
|
|
const { call, signUp } = await makeApp(db, [FIXTURES, dir]);
|
|
const owner = await signUp("[email protected]");
|
|
const author = await signUp("[email protected]");
|
|
const coAuthor = await signUp("[email protected]");
|
|
const users = (await (await call("GET", "/api/admin/users", { cookie: owner })).json()) as { id: string; email: string }[];
|
|
const id = (e: string) => users.find((u) => u.email === e)!.id;
|
|
expect((await call("PUT", `/api/admin/users/${id("[email protected]")}/roles`, { cookie: owner, body: { roles: ["author"] } })).status).toBe(200);
|
|
expect((await call("PUT", "/api/admin/courses/secret/access", { cookie: owner, body: { authors: [id("[email protected]")] } })).status).toBe(200);
|
|
|
|
const paths = ["/api/courses/secret", "/api/courses/secret/lessons/s1", "/api/media/secret/a.md"];
|
|
for (const p of paths) {
|
|
expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 404]);
|
|
expect([p, (await call("GET", p, { cookie: coAuthor })).status]).toEqual([p, 200]);
|
|
}
|
|
const lib = async (c: string) => ((await (await call("GET", "/api/library", { cookie: c })).json()) as { courses: { id: string }[] }).courses.map((x) => x.id);
|
|
expect(await lib(author)).not.toContain("secret");
|
|
expect(await lib(coAuthor)).toContain("secret");
|
|
const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: author })).json()) as unknown[];
|
|
expect(search).toEqual([]);
|
|
});
|