Follow-ups from the code review of the test-quality batches:
- Consolidate duplicated helpers into e2e/helpers/: seed.ts (seedUpload,
seedComment, listComments, findFeedRow) and sse.ts (mintSseTicket, openStream,
trackStreamOpens). Refactor authorization-deep, xss-injection, like-comment,
sse-ticket-abuse, ddos, sse-realtime, multi-tab, and SseListener to use them —
the upload/comment/ticket-flow contracts now live in one place each instead of
being re-inlined across 3–7 specs.
- xss-injection display-name loop: it navigated to /feed (which renders uploader
names, not the viewer's) so "nothing fired" passed vacuously — the payload was
never rendered. Now navigate to /account (the actual sink) and add a render
guard asserting the payload reached the DOM as escaped text before checking
__xssFired.
- sse-realtime reconnect: snapshot the stream-open count AFTER backgrounding, so
the "new connection" assertion is attributable to the foreground event and can't
be satisfied by a spurious native/error reconnect before the toggle.
- recover-page: correct the comment (auto-submit is the onPinInput handler, not an
$effect).
44 affected specs verified green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Close two malicious-input gaps flagged in the suite review: XSS was only fuzzed
through display_name, and the SSE ticket flow had no security assertions.
xss-injection:
- Stored XSS in captions — upload with each XSS payload as the caption, mark it
feed-visible, render /feed and assert window.__xssFired stays false, no dialog
fires, and no live `img[onerror]`/`<script>` element is produced (Svelte escaping
renders it as inert text). A trailing CAPMARK gates the assertion on the caption
actually having rendered, so it can't pass vacuously.
- Stored XSS in comments — post the two render-executing payloads as a comment,
open the lightbox (which loads comments) and assert the same inert-render props.
sse-ticket-abuse (new):
- Minting a ticket requires auth (POST /stream/ticket without Bearer → 401).
- Single-use: after the first open consumes the ticket, replaying it → 401 (a 200
would be capability replay). The first open (→200) also proves a fresh ticket works.
- An unminted/garbage ticket → 401.
All verified green against the live backend.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
