b1e2e66305
Follow-ups from the code review of the test-quality batches: - Consolidate duplicated helpers into e2e/helpers/: seed.ts (seedUpload, seedComment, listComments, findFeedRow) and sse.ts (mintSseTicket, openStream, trackStreamOpens). Refactor authorization-deep, xss-injection, like-comment, sse-ticket-abuse, ddos, sse-realtime, multi-tab, and SseListener to use them — the upload/comment/ticket-flow contracts now live in one place each instead of being re-inlined across 3–7 specs. - xss-injection display-name loop: it navigated to /feed (which renders uploader names, not the viewer's) so "nothing fired" passed vacuously — the payload was never rendered. Now navigate to /account (the actual sink) and add a render guard asserting the payload reached the DOM as escaped text before checking __xssFired. - sse-realtime reconnect: snapshot the stream-open count AFTER backgrounding, so the "new connection" assertion is attributable to the foreground event and can't be satisfied by a spurious native/error reconnect before the toggle. - recover-page: correct the comment (auto-submit is the onPinInput handler, not an $effect). 44 affected specs verified green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
85 lines
3.8 KiB
TypeScript
85 lines
3.8 KiB
TypeScript
/**
|
|
* Phase 2 adversarial — small-scale DDoS / oversized-body tests. These are
|
|
* NOT real load tests. We just verify that obvious abuse is rate-limited
|
|
* or rejected gracefully without crashing the backend.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
import { mintSseTicket } from '../../helpers/sse';
|
|
|
|
const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
|
|
|
|
test.describe('Adversarial — small-scale abuse', () => {
|
|
// Note: the truncate auto-fixture resets every rate-limit toggle back to false
|
|
// before each test, so we re-enable in beforeEach (not beforeAll).
|
|
test.beforeEach(async ({ api, adminToken }) => {
|
|
await api.patchConfig(adminToken, { rate_limits_enabled: 'true', join_rate_enabled: 'true' });
|
|
});
|
|
|
|
test('20 parallel /join from one IP — rate limiter catches the excess', async () => {
|
|
const requests = Array.from({ length: 20 }, (_, i) =>
|
|
fetch(`${BASE}/api/v1/join`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ display_name: `Flood${i}_${Date.now()}` }),
|
|
})
|
|
);
|
|
const statuses = (await Promise.all(requests)).map((r) => r.status);
|
|
// 5/min limit → at least some should be 429.
|
|
expect(statuses.filter((s) => s === 429).length).toBeGreaterThan(0);
|
|
// Server stays up — at least one succeeded.
|
|
expect(statuses.some((s) => s === 201 || s === 409)).toBe(true);
|
|
});
|
|
|
|
test('10 MB comment body is rejected (multipart-less endpoint)', async ({ guest }) => {
|
|
const g = await guest('BigComment');
|
|
const huge = 'A'.repeat(10 * 1024 * 1024);
|
|
const res = await fetch(`${BASE}/api/v1/upload/00000000-0000-0000-0000-000000000000/comments`, {
|
|
method: 'POST',
|
|
headers: { Authorization: `Bearer ${g.jwt}`, 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ body: huge }),
|
|
});
|
|
// 400 (length cap), 404 (no such upload), 413 (payload too large), 429 (rate-limited),
|
|
// or 502 (Caddy rejected the body before it reached the backend) — all fine.
|
|
expect([400, 404, 413, 429, 502]).toContain(res.status);
|
|
// Not 200 — that would mean we accepted a 10 MB comment.
|
|
expect(res.status).not.toBe(200);
|
|
});
|
|
|
|
test('SSE: 10 concurrent streams from one user do not crash the server', async ({ guest }) => {
|
|
const g = await guest('SseFlood');
|
|
// The stream endpoint authenticates via single-use tickets (POST /stream/ticket),
|
|
// not the raw JWT — a `?token=` open is rejected with 400. Mint one ticket per stream.
|
|
// (These streams must be held open concurrently, so we can't use the openStream
|
|
// helper which opens-and-aborts a single stream.)
|
|
const tickets = await Promise.all(Array.from({ length: 10 }, () => mintSseTicket(g.jwt)));
|
|
|
|
const controllers = tickets.map(() => new AbortController());
|
|
const requests = tickets.map((ticket, i) =>
|
|
fetch(`${BASE}/api/v1/stream?ticket=${encodeURIComponent(ticket)}`, { signal: controllers[i].signal })
|
|
);
|
|
const responses = await Promise.all(requests);
|
|
// All accepted (or some rate-limited — both fine).
|
|
for (const r of responses) {
|
|
expect([200, 429]).toContain(r.status);
|
|
}
|
|
// Tear them all down so the next test doesn't see leaked connections.
|
|
controllers.forEach((c) => c.abort());
|
|
|
|
// Sanity: a new request still works.
|
|
const ping = await fetch(`${BASE}/api/v1/me/context`, {
|
|
headers: { Authorization: `Bearer ${g.jwt}` },
|
|
});
|
|
expect(ping.status).toBe(200);
|
|
});
|
|
|
|
test('malformed JSON in /join is rejected with 400, not 500', async () => {
|
|
const res = await fetch(`${BASE}/api/v1/join`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: '{"display_name":',
|
|
});
|
|
expect([400, 422]).toContain(res.status);
|
|
expect(res.status).not.toBe(500);
|
|
});
|
|
});
|