Node / ReticulumProjects / MeshChatX.git / files / tests / frontend / RelayChatPage.security.test.js

Displaying Raw • Download

T8b949e// SPDX-License-Identifier: 0BSD

Tff7b72import Tb4b4b4{ Te6edf3mount Tb4b4b4} Tff7b72from Ta5d6ff"@vue/test-utils"Tb4b4b4;

Tff7b72import Tb4b4b4{ Te6edf3describeTb4b4b4, Te6edf3itTb4b4b4, Te6edf3expectTb4b4b4, Te6edf3viTb4b4b4, Te6edf3beforeEachTb4b4b4, Te6edf3afterEach Tb4b4b4} Tff7b72from Ta5d6ff"vitest"Tb4b4b4;

Tff7b72import Te6edf3RelayChatPage Tff7b72from Ta5d6ff"@/components/relay/RelayChatPage.vue"Tb4b4b4;

Tff7b72import Tb4b4b4{ Te6edf3mountToolsPageGlobals Tb4b4b4} Tff7b72from Ta5d6ff"./testI18n.js"Tb4b4b4;

Tff7b72const Te6edf3HUB_HASH Tff7b72= Ta5d6ff"00112233445566778899aabbccddeeff"Tb4b4b4;

Tff7b72function Te6edf3makeHubTb4b4b4(Te6edf3overrides Tff7b72= Tb4b4b4{Tb4b4b4}Tb4b4b4) Tb4b4b4{

Tff7b72return Tb4b4b4{

Te6edf3hub_hashTff7b72: Te6edf3HUB_HASHTb4b4b4,

Te6edf3dest_nameTff7b72: Ta5d6ff"rrc.hub"Tb4b4b4,

Te6edf3nameTff7b72: Ta5d6ff"Test Hub"Tb4b4b4,

Te6edf3statusTff7b72: T79c0ff2Tb4b4b4,

Te6edf3connectedTff7b72: Tff7b72trueTb4b4b4,

Te6edf3hub_nameTff7b72: Ta5d6ff"Test Hub"Tb4b4b4,

Te6edf3hub_versionTff7b72: Ta5d6ff"1"Tb4b4b4,

Te6edf3motdTff7b72: Tff7b72nullTb4b4b4,

Te6edf3roomsTff7b72: Tb4b4b4[Ta5d6ff"lobby"Tb4b4b4]Tb4b4b4,

Te6edf3known_roomsTff7b72: Tb4b4b4[Ta5d6ff"lobby"Tb4b4b4]Tb4b4b4,

Te6edf3unread_roomsTff7b72: Tb4b4b4[Tb4b4b4]Tb4b4b4,

Te6edf3mention_roomsTff7b72: Tb4b4b4[Tb4b4b4]Tb4b4b4,

Te6edf3available_roomsTff7b72: Tb4b4b4{Tb4b4b4}Tb4b4b4,

Te6edf3auto_reconnectTff7b72: Tff7b72falseTb4b4b4,

Te6edf3auto_listTff7b72: Tff7b72falseTb4b4b4,

Te6edf3auto_whoTff7b72: Tff7b72falseTb4b4b4,

Te6edf3nick_overrideTff7b72: Tff7b72nullTb4b4b4,

Te6edf3max_msg_body_bytesTff7b72: T79c0ff350Tb4b4b4,

Tb4b4b4...Te6edf3overridesTb4b4b4,

Tb4b4b4}Tb4b4b4;

Tb4b4b4}

Te6edf3describeTb4b4b4(Ta5d6ff"RelayChatPage security and fuzz"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72let Te6edf3axiosMockTb4b4b4;

Te6edf3beforeEachTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3axiosMock Tff7b72= Tb4b4b4{

Te6edf3getTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3postTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3mockResolvedValueTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3mockResolvedValueTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4,

Tff7b72deleteTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3mockResolvedValueTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4,

Tb4b4b4}Tb4b4b4;

Tffa657windowTb4b4b4.Te6edf3api Tff7b72= Te6edf3axiosMockTb4b4b4;

Te6edf3axiosMockTb4b4b4.Te6edf3getTb4b4b4.Te6edf3mockImplementationTb4b4b4(Tb4b4b4(Te6edf3urlTb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72if Tb4b4b4(Te6edf3url Tff7b72=== Ta5d6ff"/api/v1/rrc/hubs"Tb4b4b4) Tb4b4b4{

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{ Te6edf3hubsTff7b72: Tb4b4b4[Te6edf3makeHubTb4b4b4(Tb4b4b4)Tb4b4b4] Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3url Tff7b72=== Ta5d6ff"/api/v1/rrc/servers"Tb4b4b4) Tb4b4b4{

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{ Te6edf3hubsTff7b72: Tb4b4b4[Tb4b4b4] Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3url Tff7b72=== Ta5d6ff"/api/v1/announces"Tb4b4b4) Tb4b4b4{

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{ Te6edf3announcesTff7b72: Tb4b4b4[Tb4b4b4] Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3urlTb4b4b4.Te6edf3includesTb4b4b4(Ta5d6ff"/rooms/"Tb4b4b4) Tff7b72&& Te6edf3urlTb4b4b4.Te6edf3endsWithTb4b4b4(Ta5d6ff"/messages"Tb4b4b4)Tb4b4b4) Tb4b4b4{

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{ Te6edf3messagesTff7b72: Tb4b4b4[Tb4b4b4]Tb4b4b4, Te6edf3membersTff7b72: Tb4b4b4[Tb4b4b4] Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3afterEachTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72delete Tffa657windowTb4b4b4.Te6edf3apiTb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3mountPage Tff7b72= Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3mountTb4b4b4(Te6edf3RelayChatPageTb4b4b4, Tb4b4b4{ Tffa657globalTff7b72: Te6edf3mountToolsPageGlobalsTb4b4b4(Tb4b4b4) Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"encodeRoom percent-encodes path segments"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3encodeRoomTb4b4b4(Ta5d6ff"a/b"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"a%2Fb"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3encodeRoomTb4b4b4(Ta5d6ff"../lobby"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"..%2Flobby"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3encodeRoomTb4b4b4(Ta5d6ff"lobby?x=1"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"lobby%3Fx%3D1"Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"renders XSS-shaped message text as escaped text, not HTML"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3xss Tff7b72= Ta5d6ff'<img src=x onerror="alert(1)">'Tb4b4b4;

Te6edf3axiosMockTb4b4b4.Te6edf3getTb4b4b4.Te6edf3mockImplementationTb4b4b4(Tb4b4b4(Te6edf3urlTb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72if Tb4b4b4(Te6edf3urlTb4b4b4.Te6edf3includesTb4b4b4(Ta5d6ff"/messages"Tb4b4b4)Tb4b4b4) Tb4b4b4{

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{

Te6edf3dataTff7b72: Tb4b4b4{

Te6edf3messagesTff7b72: Tb4b4b4[

Tb4b4b4{

Te6edf3kindTff7b72: Ta5d6ff"msg"Tb4b4b4,

Te6edf3roomTff7b72: Ta5d6ff"lobby"Tb4b4b4,

Te6edf3srcTff7b72: Ta5d6ff"aabb"Tb4b4b4,

Te6edf3nickTff7b72: Ta5d6ff"evil"Tb4b4b4,

Te6edf3textTff7b72: Te6edf3xssTb4b4b4,

Te6edf3tsTff7b72: T79c0ff1Tb4b4b4,

Te6edf3mentionTff7b72: Tff7b72falseTb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4]Tb4b4b4,

Te6edf3membersTff7b72: Tb4b4b4[Tb4b4b4]Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3url Tff7b72=== Ta5d6ff"/api/v1/rrc/hubs"Tb4b4b4) Tb4b4b4{

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{ Te6edf3hubsTff7b72: Tb4b4b4[Te6edf3makeHubTb4b4b4(Tb4b4b4)Tb4b4b4] Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72return Tffa657PromiseTb4b4b4.Te6edf3resolveTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3selectRoomTb4b4b4(Te6edf3HUB_HASHTb4b4b4, Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3htmlTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"&lt;img"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3htmlTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toMatchTb4b4b4(Ta5d6ff/<img\s[^>]*onerror/iTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3textTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"<img"Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"ignores malformed websocket payloads without throwing"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3safePayloads Tff7b72= Tb4b4b4[

Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff"not json" Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff"" Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff'{"type":' Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff"[]" Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff"{}" Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff'{"type":"unknown"}' Tb4b4b4}Tb4b4b4,

Tb4b4b4]Tb4b4b4;

Tff7b72for Tb4b4b4(Tff7b72const Te6edf3payload Tff7b72of Te6edf3safePayloadsTb4b4b4) Tb4b4b4{

Te6edf3expectTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3onWebsocketMessageTb4b4b4(Te6edf3payloadTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toThrowTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Te6edf3expectTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3onWebsocketMessageTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Ta5d6ff"null" Tb4b4b4}Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toThrowTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"fuzz websocket event shapes without throwing"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3selectRoomTb4b4b4(Te6edf3HUB_HASHTb4b4b4, Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3before Tff7b72= Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3lengthTb4b4b4;

Tff7b72for Tb4b4b4(Tff7b72let Te6edf3i Tff7b72= T79c0ff0Tb4b4b4; Te6edf3i Tff7b72< T79c0ff50Tb4b4b4; Te6edf3iTff7b72++Tb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3event Tff7b72= Tb4b4b4{

Te6edf3dataTff7b72: Tffa657JSONTb4b4b4.Te6edf3stringifyTb4b4b4(Tb4b4b4{

Te6edf3typeTff7b72: Te6edf3i Tff7b72% T79c0ff3 Tff7b72=== T79c0ff0 Tff7b72? Ta5d6ff"rrc.message" Tff7b72: Te6edf3i Tff7b72% T79c0ff3 Tff7b72=== T79c0ff1 Tff7b72? Ta5d6ff"rrc.change" Tff7b72: Ta5d6ff"other"Tb4b4b4,

Te6edf3hub_hashTff7b72: Te6edf3i Tff7b72% T79c0ff2 Tff7b72=== T79c0ff0 Tff7b72? Te6edf3HUB_HASH Tff7b72: Ta5d6ff"deadbeef"Tb4b4b4.Te6edf3repeatTb4b4b4(T79c0ff4Tb4b4b4)Tb4b4b4,

Te6edf3roomTff7b72: Te6edf3i Tff7b72% T79c0ff2 Tff7b72=== T79c0ff0 Tff7b72? Ta5d6ff"lobby" Tff7b72: Ta5d6ff`Ta5d6ffroom-Tffd700${Te6edf3iTffd700}Ta5d6ff`Tb4b4b4,

Te6edf3messageTff7b72:

Te6edf3i Tff7b72% T79c0ff4 Tff7b72=== T79c0ff0

Tff7b72? Tb4b4b4{

Te6edf3kindTff7b72: Ta5d6ff"msg"Tb4b4b4,

Te6edf3textTff7b72: Ta5d6ff`Ta5d6ff<script>Tffd700${Te6edf3iTffd700}Ta5d6ff</script>Ta5d6ff`Tb4b4b4,

Te6edf3tsTff7b72: Te6edf3iTb4b4b4,

Te6edf3srcTff7b72: Ta5d6ff"xx"Tb4b4b4,

Te6edf3nickTff7b72: Ta5d6ff`Ta5d6ffnTffd700${Te6edf3iTffd700}Ta5d6ff`Tb4b4b4,

Tb4b4b4}

Tff7b72: Tff7b72nullTb4b4b4,

Te6edf3announceTff7b72: Te6edf3i Tff7b72% T79c0ff5 Tff7b72=== T79c0ff0 Tff7b72? Tb4b4b4{ Te6edf3aspectTff7b72: Ta5d6ff"rrc.hub"Tb4b4b4, Te6edf3destination_hashTff7b72: Ta5d6ff"ab"Tb4b4b4.Te6edf3repeatTb4b4b4(T79c0ff16Tb4b4b4) Tb4b4b4} Tff7b72: Tff7b72undefinedTb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4,

Tb4b4b4}Tb4b4b4;

Te6edf3expectTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3onWebsocketMessageTb4b4b4(Te6edf3eventTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toThrowTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeGreaterThanOrEqualTb4b4b4(Te6edf3beforeTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3htmlTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3toLowerCaseTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"<script>"Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"does not append websocket messages for mismatched hub or room"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3selectRoomTb4b4b4(Te6edf3HUB_HASHTb4b4b4, Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3selectedRoomTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3count Tff7b72= Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3lengthTb4b4b4;

Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3onWebsocketMessageTb4b4b4(Tb4b4b4{

Te6edf3dataTff7b72: Tffa657JSONTb4b4b4.Te6edf3stringifyTb4b4b4(Tb4b4b4{

Te6edf3typeTff7b72: Ta5d6ff"rrc.message"Tb4b4b4,

Te6edf3hub_hashTff7b72: Ta5d6ff"ff"Tb4b4b4.Te6edf3repeatTb4b4b4(T79c0ff16Tb4b4b4)Tb4b4b4,

Te6edf3roomTff7b72: Ta5d6ff"lobby"Tb4b4b4,

Te6edf3messageTff7b72: Tb4b4b4{

Te6edf3kindTff7b72: Ta5d6ff"msg"Tb4b4b4,

Te6edf3roomTff7b72: Ta5d6ff"lobby"Tb4b4b4,

Te6edf3srcTff7b72: Ta5d6ff"cc"Tb4b4b4,

Te6edf3nickTff7b72: Ta5d6ff"x"Tb4b4b4,

Te6edf3textTff7b72: Ta5d6ff"wrong hub"Tb4b4b4,

Te6edf3tsTff7b72: T79c0ff9Tb4b4b4,

Te6edf3mentionTff7b72: Tff7b72falseTb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3onWebsocketMessageTb4b4b4(Tb4b4b4{

Te6edf3dataTff7b72: Tffa657JSONTb4b4b4.Te6edf3stringifyTb4b4b4(Tb4b4b4{

Te6edf3typeTff7b72: Ta5d6ff"rrc.message"Tb4b4b4,

Te6edf3hub_hashTff7b72: Te6edf3HUB_HASHTb4b4b4,

Te6edf3roomTff7b72: Ta5d6ff"other"Tb4b4b4,

Te6edf3messageTff7b72: Tb4b4b4{

Te6edf3kindTff7b72: Ta5d6ff"msg"Tb4b4b4,

Te6edf3roomTff7b72: Ta5d6ff"other"Tb4b4b4,

Te6edf3srcTff7b72: Ta5d6ff"cc"Tb4b4b4,

Te6edf3nickTff7b72: Ta5d6ff"x"Tb4b4b4,

Te6edf3textTff7b72: Ta5d6ff"wrong room"Tb4b4b4,

Te6edf3tsTff7b72: T79c0ff10Tb4b4b4,

Te6edf3mentionTff7b72: Tff7b72falseTb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3filterTb4b4b4(Tb4b4b4(Te6edf3mTb4b4b4) Tb4b4b4=> Te6edf3mTb4b4b4.Te6edf3text Tff7b72=== Ta5d6ff"wrong hub"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toHaveLengthTb4b4b4(T79c0ff0Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3filterTb4b4b4(Tb4b4b4(Te6edf3mTb4b4b4) Tb4b4b4=> Te6edf3mTb4b4b4.Te6edf3text Tff7b72=== Ta5d6ff"wrong room"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toHaveLengthTb4b4b4(T79c0ff0Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3messagesTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Te6edf3countTb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"rejects prototype pollution keys in websocket JSON safely"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3selectRoomTb4b4b4(Te6edf3HUB_HASHTb4b4b4, Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3polluted Tff7b72=

Ta5d6ff'{"type":"rrc.message","hub_hash":"' Tff7b72+

Te6edf3HUB_HASH Tff7b72+

Ta5d6ff'","room":"lobby","message":{"kind":"msg","text":"p","ts":1,"src":"a","nick":"n"},"__proto__":{"polluted":true}}'Tb4b4b4;

Te6edf3expectTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3onWebsocketMessageTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Te6edf3polluted Tb4b4b4}Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toThrowTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Tffa657ObjectTb4b4b4.Te6edf3prototypeTb4b4b4.Te6edf3pollutedTb4b4b4)Tb4b4b4.Te6edf3toBeUndefinedTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"sendMessage does not pass raw script tags unencoded in API path"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3selectRoomTb4b4b4(Te6edf3HUB_HASHTb4b4b4, Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4;

Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3composer Tff7b72= Ta5d6ff"hello"Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3sendMessageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3call Tff7b72= Te6edf3axiosMockTb4b4b4.Te6edf3postTb4b4b4.Te6edf3mockTb4b4b4.Te6edf3callsTb4b4b4.Te6edf3findTb4b4b4(Tb4b4b4(Te6edf3cTb4b4b4) Tb4b4b4=> Te6edf3cTb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4.Te6edf3includesTb4b4b4(Ta5d6ff"/messages"Tb4b4b4)Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3callTb4b4b4)Tb4b4b4.Te6edf3toBeDefinedTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3callTb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Tffa657encodeURIComponentTb4b4b4(Ta5d6ff"lobby"Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"addHub strips unsafe hub_hash input before POST"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3axiosMockTb4b4b4.Te6edf3postTb4b4b4.Te6edf3mockResolvedValueOnceTb4b4b4(Tb4b4b4{ Te6edf3dataTff7b72: Tb4b4b4{ Te6edf3hubTff7b72: Te6edf3makeHubTb4b4b4(Tb4b4b4) Tb4b4b4} Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3wrapper Tff7b72= Te6edf3mountPageTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72await Te6edf3viTb4b4b4.Te6edf3waitForTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Te6edf3expectTb4b4b4(Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3hubsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4;

Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3addHubForm Tff7b72= Tb4b4b4{

Te6edf3hub_hashTff7b72: Ta5d6ff" " Tff7b72+ Te6edf3HUB_HASH Tff7b72+ Ta5d6ff" "Tb4b4b4,

Te6edf3nameTff7b72: Ta5d6ff"Hub"Tb4b4b4,

Te6edf3dest_nameTff7b72: Ta5d6ff""Tb4b4b4,

Tb4b4b4}Tb4b4b4;

Tff7b72await Te6edf3wrapperTb4b4b4.Te6edf3vmTb4b4b4.Te6edf3addHubTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3axiosMockTb4b4b4.Te6edf3postTb4b4b4)Tb4b4b4.Te6edf3toHaveBeenCalledWithTb4b4b4(

Ta5d6ff"/api/v1/rrc/hubs"Tb4b4b4,

Te6edf3expectTb4b4b4.Te6edf3objectContainingTb4b4b4(Tb4b4b4{ Te6edf3hub_hashTff7b72: Te6edf3HUB_HASH Tb4b4b4}Tb4b4b4)

Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;