From 8f6e1d4ff73cf5b123072caa412c6815ee631991 Mon Sep 17 00:00:00 2001
From: fabi <fabi@mc02.dev>
Date: Wed, 1 Jul 2026 07:34:55 +0200
Subject: [PATCH] test(e2e): stored-XSS (caption/comment) + SSE-ticket abuse
 coverage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Close two malicious-input gaps flagged in the suite review: XSS was only fuzzed
through display_name, and the SSE ticket flow had no security assertions.

xss-injection:
- Stored XSS in captions — upload with each XSS payload as the caption, mark it
  feed-visible, render /feed and assert window.__xssFired stays false, no dialog
  fires, and no live `img[onerror]`/`<script>` element is produced (Svelte escaping
  renders it as inert text). A trailing CAPMARK gates the assertion on the caption
  actually having rendered, so it can't pass vacuously.
- Stored XSS in comments — post the two render-executing payloads as a comment,
  open the lightbox (which loads comments) and assert the same inert-render props.

sse-ticket-abuse (new):
- Minting a ticket requires auth (POST /stream/ticket without Bearer → 401).
- Single-use: after the first open consumes the ticket, replaying it → 401 (a 200
  would be capability replay). The first open (→200) also proves a fresh ticket works.
- An unminted/garbage ticket → 401.

All verified green against the live backend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../07-adversarial/sse-ticket-abuse.spec.ts   |  61 ++++++++++++++++++
 .../07-adversarial/xss-injection.spec.ts      | Bin 6119 -> 10321 bytes
 2 files changed, 61 insertions(+)
 create mode 100644 e2e/specs/07-adversarial/sse-ticket-abuse.spec.ts

diff --git a/e2e/specs/07-adversarial/sse-ticket-abuse.spec.ts b/e2e/specs/07-adversarial/sse-ticket-abuse.spec.ts
new file mode 100644
index 0000000..1750887
--- /dev/null
+++ b/e2e/specs/07-adversarial/sse-ticket-abuse.spec.ts
@@ -0,0 +1,61 @@
+/**
+ * Phase 2 adversarial — SSE ticket capability abuse.
+ *
+ * The stream endpoint authenticates via short-lived, single-use tickets minted at
+ * POST /api/v1/stream/ticket (never the raw JWT in the URL). These tests pin the
+ * security properties of that flow: minting requires auth, and a ticket is consumed
+ * on first use so it cannot be replayed.
+ */
+import { test, expect } from '../../fixtures/test';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+async function mintTicket(jwt: string): Promise<string> {
+  const res = await fetch(`${BASE}/api/v1/stream/ticket`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${jwt}` },
+  });
+  if (res.status !== 200) throw new Error(`mint failed: ${res.status} ${await res.text()}`);
+  return (await res.json()).ticket;
+}
+
+/** Open the SSE stream with a ticket, return the HTTP status, and tear the stream down. */
+async function openStream(ticket: string): Promise<number> {
+  const c = new AbortController();
+  try {
+    const res = await fetch(`${BASE}/api/v1/stream?ticket=${encodeURIComponent(ticket)}`, {
+      signal: c.signal,
+    });
+    return res.status;
+  } finally {
+    c.abort();
+  }
+}
+
+test.describe('Adversarial — SSE ticket abuse', () => {
+  test('minting a ticket requires authentication', async () => {
+    const res = await fetch(`${BASE}/api/v1/stream/ticket`, { method: 'POST' });
+    expect(res.status).toBe(401);
+  });
+
+  test('a ticket is single-use: replay after first open is rejected', async ({ guest }) => {
+    const g = await guest('SseReplay');
+    const ticket = await mintTicket(g.jwt);
+
+    // First open consumes the ticket.
+    expect(await openStream(ticket)).toBe(200);
+
+    // Replaying the exact same ticket must fail — it was consumed, so `consume` returns
+    // None → 401. A 200 here would mean tickets are reusable (capability replay).
+    expect(await openStream(ticket)).toBe(401);
+  });
+
+  test('an unminted / garbage ticket is rejected', async () => {
+    // 24-byte-shaped hex string that was never issued.
+    const bogus = 'deadbeef'.repeat(6);
+    expect(await openStream(bogus)).toBe(401);
+  });
+  // Note: the replay test's first open (→ 200) already proves a freshly-minted ticket
+  // works, so there is no separate "fresh ticket" sanity test — a second successful open
+  // would just add ~30s (SSE headers flush on the keep-alive tick through Caddy).
+});
diff --git a/e2e/specs/07-adversarial/xss-injection.spec.ts b/e2e/specs/07-adversarial/xss-injection.spec.ts
index 701f789248c75a53b53cb66098b0f35f8ed8ef50..44899502f041d20c5501c341f21753a57551b1ad 100644
GIT binary patch
delta 3176
zcmbtWU2hvj6qQ<)k~9UXHZA=?x{XqKw{_NTg{sP_5l$M~(zvmb6bhk=$Gc;D()G@2
zXEu&yS%x3L(;^`xB>qCBN{Bav^1=fM@e}9^e}V_@%<S56sh}!WtjN1Fcg{Wc+;iv8
z!tb>w`-dv56Y@wxAL7vG#9JrbJbYMNxxHPj+`hXE187FP13AYj;9r~iA&o@AtX*(@
zMuX(XL#xBW<;$=^sRsliO8h)D@yEh06RhFWG&JyTfGZk3sPA-TeGym6I0^(XiC@ow
z%Y|todVvegIB+H70SJupkqPoZ!?SQ_351MT(8_~LLba>}UiQRmlz;?1y970a%>=z^
z-n<9>X#kf8LPCRkJt#v!yYPSo@<t_!NYA=jy!NiWh>O%~M^I^vS;#{XUnLjMoEnZ;
zQb_W8aURKQGM@&dLraj`b9Ta34#Dw2(m-zZLiLn&NQ)MBLaJXG+%V7wvL;v&6^@WZ
z#sV&u%W$oD)dty)cvr(*i6S0Zb!21cWn?x99_f`}zCYeOz+a?Gm_%xYBk7*B>_J^0
zVp8uT&sfqjj92Xl9$0!wp#W79Jx1W25cdmJ0FMV01V=0s*^WE{OkjC@zlTQz9*wY|
zEYPo2#U13&g!USWLsPWnalj3oqs6>D<W%gOKG_HXu`Nyyo=zS9W$L7mT!ntPu>n?E
z<>arK`Q+Y_b4Rn^>`19#K%jgA8p(PdjDD;>v|=i-K3*daAu^u_!CJxH<jL{V$)~4J
z4Ic_&jt2Z-;uVk)5{jyV4st*v@F}Vi%c1Fv1Ihf91T8se69L4PF`1yEL7RvhNl3#I
zArO~}8gSWG|C>zZHGKB@SAb7w)J2VA)1*1!5kz9icM-sd-!6}R53>*gc8MGFSol3f
zwECE`Vo|e_{<C9Rj#g@Yz8{jFYViRqpRd%amGyf_nAgx1P_gJ<NL^_q!&8@%U#H$b
z4;~{vZwV)iMceY64r&6av}}7ZxiS6DP|G*PVT!If4lF}>YZMsy{aA?-xtZWl2^1s;
zp9CWn-CC=HMFsLfQ6osQ&m@fql8=k+ENyjM^26-Otxcuz+_Fgro34*pU|CAgBt8;5
zupJ~^U>n$u<V!U564Zxe9m-=|c(u4)EEW&ulJW4<>$AzTY5M|7H7k$OV<$!r!E)+S
zCby4W8)}Cf)i9@yx<hv9Dh*n)Z7J(e^lF`LVjrbtFo7D>XjkW#*KrBvyi0-lw1fTu
z1rTn;LYd{B!ZVC3sy}ml?h<Sm3tgtQg<YlW;t}F-ISSXZF@XSCRzcI3fD4VWr<rNc
zOY{KPjD<I5E|s>o_k{RBDR<6(J}lj%ZY+tid4qEzZt~5{&EZ5d^Nz~O##&i6l#MT=
zKol{u%QJF>>4Z^-nNt-0v@gI)Ph-Ijs#bZ`E<<+;F#9{3)m5Y%qk5bQ7-F$(P#s4D
z9=F;`a$&@g4ee?MkeLc-ZmIU5%VZk`g1sqxwBhUfUn7I9wrub{@Hr1vIZXF0uT`rn
z_cym|l}}dJDz`SU7q@i9>o*n6B6)cDO7g|w!rUVz1l0tV*_a7|HzAFY+&^;WDEhCW
zD0xMH8<H52M<YkjPKZ6ykrSr(63$@)8T-hE%!P5E9k30gxyG?26q%|&uBZ5QJ=DWW
z?Jij8Xbpl*hqIeUDB4jg8yxO>^2b{jXU%ji%=ei$D5P;j^4f`FGB|Vg_!!Tio=<*z
zb0KM*ID1ab>k>@ZTXj>rTk_?J3vavYqtR+Sz*55%r}@uQEC1Kx44{Mky%th44M$qB
zx^3pRQ8L66a3xi*P(xM~Sv<#sz9uZiQlg&AFjVb5?rwsk#PxAzqN(}lifCgvhLi>3
z1tY7?0ngJSRL0}9s9fr;bDvtdh7PW+GQF@YF&r;gpH{U0{r-0}3Ub;Fao-TX#%EGD
zH~{Zu3{{<-ML4k4!F!|oSY0|&ghm4+%F23VW8TBm*0v&qUY;}aXztM#i5OY%NrU=$
z1#0xlbJ^Af$)r!`(EBpaoq(S$o5Vg^o6V`wv>#?=0?XVAY(4k0$(%Xz3(qi|r}N1O
u@<sD$63TOPY4*PdQ|ey-KA6lR?eQ-hO#c`uW6iz7L>Zm-^xK(x$NmQH2^Z1;

delta 21
dcmcZ@@LYexVW!C(%pRLpu%6=FY%eRs4FG3k2l4;_