Micron Document
NexusPi Git Node

Node / mirrors / MeshChatX / files / tests / frontend / securityAdversarialOracle.test.js

Displaying Raw • Download

tests/frontend/securityAdversarialOracle.test.js 786bddfe0aebae27a59e4e8aa7a87ae9a1163c12 (786bddfe) Text, 4.62 KB

T8b949e// SPDX-License-Identifier: 0BSD

T8b949e/**
* Adversarial oracles for XSS and privacy on frontend sanitizers.
* Expected outcome is computed from the payload (executable URL / dangerous tag)
* then compared to sanitizer output.
*/

Tff7b72import Tb4b4b4{ Te6edf3describeTb4b4b4, Te6edf3expectTb4b4b4, Te6edf3it Tb4b4b4} Tff7b72from Ta5d6ff"vitest"Tb4b4b4;
Tff7b72import Te6edf3DOMPurify Tff7b72from Ta5d6ff"dompurify"Tb4b4b4;
Tff7b72import Te6edf3DocsPage Tff7b72from Ta5d6ff"@/components/docs/DocsPage.vue"Tb4b4b4;
Tff7b72import Te6edf3MarkdownRenderer Tff7b72from Ta5d6ff"@/js/MarkdownRenderer.js"Tb4b4b4;
Tff7b72import Te6edf3LinkUtils Tff7b72from Ta5d6ff"@/js/LinkUtils.js"Tb4b4b4;
Tff7b72import Tb4b4b4{ Te6edf3sanitizeNomadHtmlFragment Tb4b4b4} Tff7b72from Ta5d6ff"@/js/NomadPageRenderer.js"Tb4b4b4;
Tff7b72import Tb4b4b4{ Te6edf3sanitizeKmlText Tb4b4b4} Tff7b72from Ta5d6ff"@/js/mapExchange/kmlSanitize.js"Tb4b4b4;

Tff7b72const Te6edf3EXECUTABLE_HREFS Tff7b72= Tb4b4b4[
Ta5d6ff"javascript:alert(1)"Tb4b4b4,
Ta5d6ff"JAVASCRIPT:alert(1)"Tb4b4b4,
Ta5d6ff"vbscript:msgbox(1)"Tb4b4b4,
Ta5d6ff"data:text/html,<script>alert(1)</script>"Tb4b4b4,
Ta5d6ff"data:image/svg+xml,<svg onload=alert(1)>"Tb4b4b4,
Tb4b4b4]Tb4b4b4;

Tff7b72function Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3htmlTb4b4b4) Tb4b4b4{
Te6edf3expectTb4b4b4(Tff7b72typeof Te6edf3htmlTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"string"Tb4b4b4)Tb4b4b4;
Tff7b72const Te6edf3lower Tff7b72= Te6edf3htmlTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/<script[\s>]/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/<iframe[\s>]/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/\bhref\s*=\s*["']?\s*javascript:/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/\bsrc\s*=\s*["']?\s*javascript:/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/\bhref\s*=\s*["']?\s*vbscript:/Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/\bhref\s*=\s*["']?\s*data:text\/html/Tb4b4b4)Tb4b4b4;
Tb4b4b4}

Te6edf3describeTb4b4b4(Ta5d6ff"adversarial XSS oracles"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Te6edf3itTb4b4b4(Ta5d6ff"chat markdown never emits executable hrefs or script tags"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3href Tff7b72of Te6edf3EXECUTABLE_HREFSTb4b4b4) Tb4b4b4{
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderTb4b4b4(Ta5d6ff`Ta5d6ffsee Tffd700${Te6edf3hrefTffd700}Ta5d6ff hereTa5d6ff`Tb4b4b4)Tb4b4b4)Tb4b4b4;
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderBasicTb4b4b4(Ta5d6ff`Ta5d6ffsee Tffd700${Te6edf3hrefTffd700}Ta5d6ff hereTa5d6ff`Tb4b4b4)Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderTb4b4b4(Ta5d6ff"<script>alert(1)</script>"Tb4b4b4)Tb4b4b4)Tb4b4b4;
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderTb4b4b4(Ta5d6ff'<img src=x onerror="alert(1)">'Tb4b4b4)Tb4b4b4)Tb4b4b4;
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3MarkdownRendererTb4b4b4.Te6edf3renderTb4b4b4(Ta5d6ff"<svg onload=alert(1)>"Tb4b4b4)Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"LinkUtils.httpUrlHrefOrNull rejects non-http schemes"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72for Tb4b4b4(Tff7b72const Te6edf3href Tff7b72of Te6edf3EXECUTABLE_HREFSTb4b4b4) Tb4b4b4{
Te6edf3expectTb4b4b4(Te6edf3LinkUtilsTb4b4b4.Te6edf3httpUrlHrefOrNullTb4b4b4(Te6edf3hrefTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeNullTb4b4b4(Tb4b4b4)Tb4b4b4;
Tb4b4b4}
Te6edf3expectTb4b4b4(Te6edf3LinkUtilsTb4b4b4.Te6edf3httpUrlHrefOrNullTb4b4b4(Ta5d6ff"https://example.com/a"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"https://example.com/a"Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"Nomad HTML sanitizer drops script, javascript href, and remote img"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72const Te6edf3html Tff7b72= Te6edf3sanitizeNomadHtmlFragmentTb4b4b4(
Ta5d6ff'<script>alert(1)</script><a href="javascript:alert(1)">x</a>' Tff7b72+
Ta5d6ff'<img src="https://evil.example/i.png" onerror="alert(1)">' Tff7b72+
Ta5d6ff"<p>ok</p>"
Tb4b4b4)Tb4b4b4;
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3htmlTb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3htmlTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"ok"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3htmlTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"evil.example"Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"map draw-feature DOMPurify policy strips script and javascript href"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72const Te6edf3dirty Tff7b72=
Ta5d6ff'<script>alert(1)</script><a href="javascript:alert(1)">x</a>' Tff7b72+
Ta5d6ff'<img src=x onerror="alert(1)"><p>camp</p>'Tb4b4b4;
Tff7b72const Te6edf3html Tff7b72= Te6edf3DOMPurifyTb4b4b4.Te6edf3sanitizeTb4b4b4(Te6edf3dirtyTb4b4b4, Tb4b4b4{
Te6edf3USE_PROFILESTff7b72: Tb4b4b4{ Te6edf3htmlTff7b72: Tff7b72true Tb4b4b4}Tb4b4b4,
Te6edf3FORBID_ATTRTff7b72: Tb4b4b4[Ta5d6ff"style"Tb4b4b4]Tb4b4b4,
Tb4b4b4}Tb4b4b4)Tb4b4b4;
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3htmlTb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3htmlTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"camp"Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"Docs search highlight escapes HTML even when the query looks like a tag"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72const Te6edf3highlightMatch Tff7b72= Te6edf3DocsPageTb4b4b4.Te6edf3methodsTb4b4b4.Te6edf3highlightMatchTb4b4b4;
Tff7b72const Te6edf3html Tff7b72= Te6edf3highlightMatchTb4b4b4.Te6edf3callTb4b4b4(Tb4b4b4{ Te6edf3searchQueryTff7b72: Ta5d6ff"<script>" Tb4b4b4}Tb4b4b4, Ta5d6ff'<img onerror="alert(1)"> hello <script>'Tb4b4b4)Tb4b4b4;
Te6edf3assertNoExecutableHtmlTb4b4b4(Te6edf3htmlTb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3htmlTb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"&lt;"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3htmlTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"<img"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3htmlTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"<script>"Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"KML sanitizer strips xlink href, vbscript, and nested description HTML"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{
Tff7b72const Te6edf3kml Tff7b72= Ta5d6ff`Ta5d6ff<?xml version="1.0"?>
kml xmlns="http://www.opengis.net/kml/2.2" xmlns:xlink="http://www.w3.org/1999/xlink"><Document>
Placemark><name>P</name>
description><a href="javascript:alert(1)">x</a></description>
Style><IconStyle><Icon xlink:href="https://evil.example/i.png"></Icon></IconStyle></Style>
Style><IconStyle><Icon><href>vbscript:msgbox(1)</href></Icon></IconStyle></Style>
Point><coordinates>1,2,0</coordinates></Point>
/Placemark></Document></kml>Ta5d6ff`Tb4b4b4;
Tff7b72const Te6edf3out Tff7b72= Te6edf3sanitizeKmlTextTb4b4b4(Te6edf3kmlTb4b4b4)Tb4b4b4;
Tff7b72const Te6edf3lower Tff7b72= Te6edf3outTb4b4b4.Te6edf3textTb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"https://evil.example"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"javascript:"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"vbscript:"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"<a "Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3lowerTb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"placemark"Tb4b4b4)Tb4b4b4;
Te6edf3expectTb4b4b4(Te6edf3outTb4b4b4.Te6edf3strippedTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeGreaterThanTb4b4b4(T79c0ff0Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;
Tb4b4b4}Tb4b4b4)Tb4b4b4;

Served by rngit 1.5.2 - Generated in 0.02s