02971f3186
An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
- banned-user cannot like / comment (the only coverage of those ban invariants)
- host cannot promote a real guest (or self) to admin — asserts nobody's role changed
- IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.
New coverage for paths that ran in production but in zero tests:
- quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
version was itself vacuous and is documented as such). Proven to fail without the guard.
- authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
anonymous + __truncate. No live hole found; the whole surface is now locked.
- ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.
Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
2.6 KiB
TypeScript
62 lines
2.6 KiB
TypeScript
/**
|
|
* Phase 2 adversarial — UI-side defenses. Confirms that Svelte's default
|
|
* text interpolation escapes everywhere user-supplied content surfaces.
|
|
*
|
|
* This is a belt-and-braces test: Svelte 5 escapes `{value}` by default,
|
|
* so failures here would mean someone reached for `{@html}` somewhere
|
|
* they shouldn't.
|
|
*/
|
|
import { test, expect } from '../../fixtures/test';
|
|
|
|
test.describe('Adversarial — UI render escape', () => {
|
|
test('display name with <script> renders as text on /account', async ({ page, api }) => {
|
|
const payload = `<script>window.__xssFired=true</script><b>BOLD</b>`;
|
|
const r = await api.join(payload);
|
|
|
|
await page.goto('/');
|
|
await page.evaluate(({ j, u, n, p }) => {
|
|
localStorage.setItem('eventsnap_jwt', j);
|
|
localStorage.setItem('eventsnap_user_id', u);
|
|
localStorage.setItem('eventsnap_display_name', n);
|
|
localStorage.setItem('eventsnap_pin', p);
|
|
}, { j: r.jwt, u: r.user_id, n: payload, p: r.pin });
|
|
|
|
page.on('dialog', (d) => {
|
|
throw new Error(`Dialog fired: ${d.message()}`);
|
|
});
|
|
|
|
await page.goto('/account');
|
|
|
|
// Render guard FIRST. `domcontentloaded` fires before Svelte hydrates, so asserting
|
|
// the *absence* of a <b> at that point passes on a page that never rendered the name
|
|
// at all — a false green on an XSS test. Prove the payload actually reached the DOM
|
|
// (as escaped text) before concluding anything about how it was rendered.
|
|
await expect(page.getByText(payload, { exact: false }).first()).toBeVisible({ timeout: 10_000 });
|
|
|
|
const fired = await page.evaluate(() => (window as any).__xssFired === true);
|
|
expect(fired).toBe(false);
|
|
|
|
// <b> tag inside the name should also not render as bold — Svelte escapes the entire
|
|
// string. toHaveCount auto-retries, so this can't win by racing hydration.
|
|
await expect(page.locator('b:has-text("BOLD")')).toHaveCount(0);
|
|
await expect(page.locator('script:has-text("__xssFired")')).toHaveCount(0);
|
|
});
|
|
|
|
test('rendering of a known SQL-injection-shaped name does not break the page', async ({ page, api }) => {
|
|
const payload = `'); DROP TABLE users; --`;
|
|
const r = await api.join(payload);
|
|
|
|
await page.goto('/');
|
|
await page.evaluate(({ j, u, n, p }) => {
|
|
localStorage.setItem('eventsnap_jwt', j);
|
|
localStorage.setItem('eventsnap_user_id', u);
|
|
localStorage.setItem('eventsnap_display_name', n);
|
|
localStorage.setItem('eventsnap_pin', p);
|
|
}, { j: r.jwt, u: r.user_id, n: payload, p: r.pin });
|
|
|
|
await page.goto('/account');
|
|
// Page renders.
|
|
await expect(page.getByRole('link', { name: 'Galerie' })).toBeVisible();
|
|
});
|
|
});
|