fabi/EventSnap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(e2e): de-vacuum security tests; add quota, authz-sweep, keepsake-regen coverage

Browse Source 
An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
  - banned-user cannot like / comment (the only coverage of those ban invariants)
  - host cannot promote a real guest (or self) to admin — asserts nobody's role changed
  - IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.

New coverage for paths that ran in production but in zero tests:
  - quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
    uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
    version was itself vacuous and is documented as such). Proven to fail without the guard.
  - authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
    anonymous + __truncate. No live hole found; the whole surface is now locked.
  - ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
    paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.

Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
fabi
2026-07-15 07:26:40 +02:00
parent e5201a9889
commit 02971f3186
13 changed files with 681 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
e2e/specs/07-adversarial/xss-injection.spec.ts
View File

@@ -16,15 +16,29 @@ import { seedUpload, seedComment } from '../../helpers/seed';
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
/**
* Every payload sets `window.__x = 1` if it executes. The marker is deliberately terse:
* the join handler caps display names at 50 chars, and a payload that trips that cap is
* rejected at the API — which means it is NEVER stored and NEVER rendered, so the test
* that "nothing executed" proves nothing at all. Each payload below is < 50 chars, so it
* survives the join and actually reaches the render sink under test.
*/
const XSS_PAYLOADS = [
`<script>window.__xssFired=true</script>`,
`<img src=x onerror="window.__xssFired=true">`,
`"><svg onload="window.__xssFired=true">`,
`<iframe src="javascript:window.parent.__xssFired=true"></iframe>`,
`javascript:window.__xssFired=true`,
`<a href="javascript:window.__xssFired=true">click</a>`,
`<script>window.__x=1</script>`, // 29
`<img src=x onerror="window.__x=1">`, // 34
`"><svg onload="window.__x=1">`, // 29
`<iframe src="javascript:parent.__x=1"></iframe>`, // 47
`javascript:window.__x=1`, // 23
`<a href="javascript:window.__x=1">c</a>`, // 39
];
// Guard the invariant the payloads depend on: if the display-name cap ever changes, or a
// payload is edited past it, we want a loud failure here rather than six silent no-ops.
const NAME_MAX = 50;
for (const p of XSS_PAYLOADS) {
if (p.length > NAME_MAX) throw new Error(`XSS payload exceeds the ${NAME_MAX}-char display-name cap and would never be stored: ${p}`);
}
const SQLI_PAYLOADS = [
`'; DROP TABLE "user"; --`,
`' OR 1=1 --`,
@@ -35,19 +49,10 @@ const SQLI_PAYLOADS = [
test.describe('Adversarial — input injection (display name)', () => {
for (const payload of XSS_PAYLOADS) {
test(`name with XSS payload ${JSON.stringify(payload).slice(0, 40)} never executes`, async ({ api, page }) => {
// Payloads > 50 chars are rejected by the join handler — that's a valid defense.
// Only if the API accepts the payload do we proceed to assert it never executes
// when rendered.
let res;
try {
res = await api.join(payload);
} catch (e: any) {
if (/→ 400/.test(e.message ?? '')) {
// Defended at the API. No need to render.
return;
}
throw e;
}
// No try/catch escape hatch: every payload is short enough to be accepted, so a
// rejection here is a real failure (the payload would never be rendered, and the
// "nothing executed" assertions below would be vacuous).
const res = await api.join(payload);
expect(res.jwt).toBeTruthy();
// Render the name in the account page by signing in.
@@ -74,12 +79,12 @@ test.describe('Adversarial — input injection (display name)', () => {
// so a "nothing fired" pass can't be because the name was never rendered.
await expect(page.getByText(payload, { exact: false }).first()).toBeVisible({ timeout: 10_000 });
const fired = await page.evaluate(() => (window as any).__xssFired === true);
expect(fired, 'window.__xssFired should never be set').toBe(false);
const fired = await page.evaluate(() => (window as any).__x === 1);
expect(fired, 'window.__x should never be set').toBe(false);
expect(dialogs, 'no dialogs should appear').toHaveLength(0);
// Inline script tag in the displayed name should be rendered as text, not parsed.
const scriptCount = await page.locator('script:has-text("window.__xssFired")').count();
const scriptCount = await page.locator('script:has-text("window.__x")').count();
expect(scriptCount, 'no executable script tags rendered from name').toBe(0);
});
}
@@ -101,11 +106,11 @@ test.describe('Adversarial — stored XSS (caption)', () => {
// Wait for the caption text to land in the DOM (escaped, as literal text).
await expect(page.getByText('CAPMARK', { exact: false }).first()).toBeVisible({ timeout: 10_000 });
expect(await page.evaluate(() => (window as any).__xssFired === true), 'caption XSS must not fire').toBe(false);
expect(await page.evaluate(() => (window as any).__x === 1), 'caption XSS must not fire').toBe(false);
expect(dialogs, 'no dialogs from a caption').toHaveLength(0);
// The payload must be inert text, not a live element / script.
expect(await page.locator('img[onerror]').count(), 'no live onerror img from caption').toBe(0);
expect(await page.locator('script:has-text("__xssFired")').count(), 'no executable script from caption').toBe(0);
expect(await page.locator('script:has-text("window.__x")').count(), 'no executable script from caption').toBe(0);
});
}
});
@@ -114,8 +119,8 @@ test.describe('Adversarial — stored XSS (comment)', () => {
// The two payloads that actually execute on render (script injection via innerHTML
// does not) — enough to prove the comment body is escaped without a slow 6× lightbox loop.
const COMMENT_PAYLOADS = [
`<img src=x onerror="window.__xssFired=true">`,
`"><svg onload="window.__xssFired=true">`,
`<img src=x onerror="window.__x=1">`,
`"><svg onload="window.__x=1">`,
];
for (const payload of COMMENT_PAYLOADS) {
test(`comment with XSS payload ${JSON.stringify(payload).slice(0, 40)} renders inert`, async ({ guest, page, signIn }) => {
@@ -139,7 +144,7 @@ test.describe('Adversarial — stored XSS (comment)', () => {
// Wait until the comment (marker) has rendered.
await expect(lightbox.getByText('CMTMARK', { exact: false })).toBeVisible({ timeout: 10_000 });
expect(await page.evaluate(() => (window as any).__xssFired === true), 'comment XSS must not fire').toBe(false);
expect(await page.evaluate(() => (window as any).__x === 1), 'comment XSS must not fire').toBe(false);
expect(dialogs, 'no dialogs from a comment').toHaveLength(0);
expect(await page.locator('img[onerror]').count(), 'no live onerror img from comment').toBe(0);
});