SparkN0de-git - /page/blob.mu

Address:

Micron Document

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

| SparkN0de-git | SparkN0de |

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Node / ReticulumProjects / MeshChatX.git / files / tests / frontend / swCachePolicy.adversarial.test.js

Displaying Raw • Download

tests/frontend/swCachePolicy.adversarial.test.js dff83e198e78b84ec225e53ce3ab119f598b0a01 (dff83e19) Text, 5.34 KB

T8b949e// SPDX-License-Identifier: 0BSD

T8b949e/**

* Adversarial fuzzing and independent oracles for shell cache policy.

*/

Tff7b72import Tb4b4b4{ Te6edf3describeTb4b4b4, Te6edf3expectTb4b4b4, Te6edf3it Tb4b4b4} Tff7b72from Ta5d6ff"vitest"Tb4b4b4;

Tff7b72import Tb4b4b4{

Te6edf3cacheNameForBuildTb4b4b4,

Te6edf3classifyShellRequestTb4b4b4,

Te6edf3isApiPathTb4b4b4,

Te6edf3shouldBypassCacheTb4b4b4,

Tb4b4b4} Tff7b72from Ta5d6ff"../../meshchatx/src/frontend/js/pwa/swCachePolicy.js"Tb4b4b4;

Tff7b72import Tb4b4b4{ Te6edf3oracleExpectedStrategy Tb4b4b4} Tff7b72from Ta5d6ff"../../meshchatx/src/frontend/js/pwa/swShellRuntime.js"Tb4b4b4;

Tff7b72function Te6edf3mulberry32Tb4b4b4(Te6edf3seedTb4b4b4) Tb4b4b4{

Tff7b72let Te6edf3t Tff7b72= Te6edf3seed Tff7b72>>> T79c0ff0Tb4b4b4;

Tff7b72return Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3t Tff7b72+= T79c0ff0x6d2b79f5Tb4b4b4;

Tff7b72let Te6edf3r Tff7b72= Tffa657MathTb4b4b4.Te6edf3imulTb4b4b4(Te6edf3t Tff7b72^ Tb4b4b4(Te6edf3t Tff7b72>>> T79c0ff15Tb4b4b4)Tb4b4b4, T79c0ff1 Tff7b72| Te6edf3tTb4b4b4)Tb4b4b4;

Te6edf3r Tff7b72^= Te6edf3r Tff7b72+ Tffa657MathTb4b4b4.Te6edf3imulTb4b4b4(Te6edf3r Tff7b72^ Tb4b4b4(Te6edf3r Tff7b72>>> T79c0ff7Tb4b4b4)Tb4b4b4, T79c0ff61 Tff7b72| Te6edf3rTb4b4b4)Tb4b4b4;

Tff7b72return Tb4b4b4(Tb4b4b4(Te6edf3r Tff7b72^ Tb4b4b4(Te6edf3r Tff7b72>>> T79c0ff14Tb4b4b4)Tb4b4b4) Tff7b72>>> T79c0ff0Tb4b4b4) Tff7b72/ T79c0ff4294967296Tb4b4b4;

Tb4b4b4}Tb4b4b4;

Tb4b4b4}

Tff7b72function Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4, Te6edf3init Tff7b72= Tb4b4b4{Tb4b4b4}Tb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3headers Tff7b72= Tff7b72new Te6edf3HeadersTb4b4b4(Te6edf3initTb4b4b4.Te6edf3headers Tff7b72|| Tb4b4b4{Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tff7b72return Tb4b4b4{

Te6edf3urlTb4b4b4,

Te6edf3methodTff7b72: Te6edf3initTb4b4b4.Te6edf3method Tff7b72|| Ta5d6ff"GET"Tb4b4b4,

Te6edf3modeTff7b72: Te6edf3initTb4b4b4.Te6edf3mode Tff7b72|| Ta5d6ff"cors"Tb4b4b4,

Te6edf3destinationTff7b72: Te6edf3initTb4b4b4.Te6edf3destination Tff7b72|| Ta5d6ff""Tb4b4b4,

Te6edf3headersTb4b4b4,

Tb4b4b4}Tb4b4b4;

Tb4b4b4}

Tff7b72function Te6edf3assertClassifyMatchesOracleTb4b4b4(Te6edf3requestTb4b4b4, Te6edf3urlTb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3actual Tff7b72= Te6edf3classifyShellRequestTb4b4b4(Te6edf3requestTb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3expected Tff7b72= Te6edf3oracleExpectedStrategyTb4b4b4(Tb4b4b4{

Te6edf3methodTff7b72: Te6edf3requestTb4b4b4.Te6edf3methodTb4b4b4,

Te6edf3pathnameTff7b72: Te6edf3urlTb4b4b4.Te6edf3pathnameTb4b4b4,

Te6edf3modeTff7b72: Te6edf3requestTb4b4b4.Te6edf3modeTb4b4b4,

Te6edf3destinationTff7b72: Te6edf3requestTb4b4b4.Te6edf3destinationTb4b4b4,

Te6edf3acceptTff7b72: Te6edf3requestTb4b4b4.Te6edf3headersTb4b4b4.Te6edf3getTb4b4b4(Ta5d6ff"accept"Tb4b4b4) Tff7b72|| Ta5d6ff""Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3actualTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Te6edf3expectedTb4b4b4)Tb4b4b4;

Tff7b72if Tb4b4b4(Te6edf3expected Tff7b72=== Ta5d6ff"bypass"Tb4b4b4) Tb4b4b4{

Te6edf3expectTb4b4b4(Te6edf3shouldBypassCacheTb4b4b4(Te6edf3requestTb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72trueTb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3expected Tff7b72=== Ta5d6ff"asset"Tb4b4b4) Tb4b4b4{

Te6edf3expectTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3pathnameTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"/assets"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72trueTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3isApiPathTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3pathnameTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72falseTb4b4b4)Tb4b4b4;

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3expected Tff7b72=== Ta5d6ff"bypass" Tff7b72&& Tb4b4b4(Te6edf3urlTb4b4b4.Te6edf3pathnameTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"/api"Tb4b4b4) Tff7b72|| Te6edf3urlTb4b4b4.Te6edf3pathnameTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"/ws"Tb4b4b4)Tb4b4b4)Tb4b4b4) Tb4b4b4{

Te6edf3expectTb4b4b4(Tb4b4b4[Ta5d6ff"bypass"Tb4b4b4]Tb4b4b4)Tb4b4b4.Te6edf3toContainTb4b4b4(Te6edf3actualTb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}

Te6edf3describeTb4b4b4(Ta5d6ff"swCachePolicy adversarial / oracle"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3itTb4b4b4(Ta5d6ff"oracle: API and WS never classify as cacheable strategies"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72for Tb4b4b4(Tff7b72const Te6edf3pathname Tff7b72of Tb4b4b4[Ta5d6ff"/api"Tb4b4b4, Ta5d6ff"/api/v1/status"Tb4b4b4, Ta5d6ff"/api/v1/auth/status"Tb4b4b4, Ta5d6ff"/ws"Tb4b4b4, Ta5d6ff"/ws/telephone/audio"Tb4b4b4]Tb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3url Tff7b72= Tff7b72new Te6edf3URLTb4b4b4(Ta5d6ff`Ta5d6ffhttps://127.0.0.1Tffd700${Te6edf3pathnameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;

Te6edf3assertClassifyMatchesOracleTb4b4b4(Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3hrefTb4b4b4)Tb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3classifyShellRequestTb4b4b4(Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3hrefTb4b4b4)Tb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"bypass"Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"oracle: mutating methods always bypass even for assets"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3url Tff7b72= Tff7b72new Te6edf3URLTb4b4b4(Ta5d6ff"https://127.0.0.1/assets/app.js"Tb4b4b4)Tb4b4b4;

Tff7b72for Tb4b4b4(Tff7b72const Te6edf3method Tff7b72of Tb4b4b4[Ta5d6ff"POST"Tb4b4b4, Ta5d6ff"PUT"Tb4b4b4, Ta5d6ff"PATCH"Tb4b4b4, Ta5d6ff"DELETE"Tb4b4b4, Ta5d6ff"OPTIONS"Tb4b4b4]Tb4b4b4) Tb4b4b4{

Te6edf3assertClassifyMatchesOracleTb4b4b4(Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3hrefTb4b4b4, Tb4b4b4{ Te6edf3method Tb4b4b4}Tb4b4b4)Tb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3classifyShellRequestTb4b4b4(Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3hrefTb4b4b4, Tb4b4b4{ Te6edf3method Tb4b4b4}Tb4b4b4)Tb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"bypass"Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"oracle: path traversal-looking API prefixes still bypass"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72for Tb4b4b4(Tff7b72const Te6edf3pathname Tff7b72of Tb4b4b4[Ta5d6ff"/api/../api/v1/status"Tb4b4b4, Ta5d6ff"/api/%2e%2e/v1/status"Tb4b4b4]Tb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3url Tff7b72= Tff7b72new Te6edf3URLTb4b4b4(Ta5d6ff`Ta5d6ffhttps://127.0.0.1Tffd700${Te6edf3pathnameTffd700}Ta5d6ff`Tb4b4b4)Tb4b4b4;

T8b949e// URL parser normalizes ../ so /api/../api/v1/status -> /api/v1/status

Te6edf3assertClassifyMatchesOracleTb4b4b4(Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3hrefTb4b4b4)Tb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"oracle: cache names never escape prefix and sanitize hostile build ids"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3hostile Tff7b72= Tb4b4b4[Ta5d6ff"../escape"Tb4b4b4, Ta5d6ff"a/b"Tb4b4b4, Ta5d6ff"x y"Tb4b4b4, Ta5d6ff"v1;drop"Tb4b4b4, Ta5d6ff"✨"Tb4b4b4, Ta5d6ff""Tb4b4b4]Tb4b4b4;

Tff7b72for Tb4b4b4(Tff7b72const Te6edf3buildId Tff7b72of Te6edf3hostileTb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3name Tff7b72= Te6edf3cacheNameForBuildTb4b4b4(Te6edf3buildIdTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3nameTb4b4b4.Te6edf3startsWithTb4b4b4(Ta5d6ff"meshchatx-shell-v"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72trueTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3nameTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"/"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3nameTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff" "Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3nameTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff";"Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"fuzz: random path/method/mode inputs match independent oracle"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3rand Tff7b72= Te6edf3mulberry32Tb4b4b4(T79c0ff0xcaceTb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3methods Tff7b72= Tb4b4b4[Ta5d6ff"GET"Tb4b4b4, Ta5d6ff"HEAD"Tb4b4b4, Ta5d6ff"POST"Tb4b4b4, Ta5d6ff"PUT"Tb4b4b4, Ta5d6ff"DELETE"Tb4b4b4, Ta5d6ff"PATCH"Tb4b4b4, Ta5d6ff"OPTIONS"Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3modes Tff7b72= Tb4b4b4[Ta5d6ff"cors"Tb4b4b4, Ta5d6ff"navigate"Tb4b4b4, Ta5d6ff"no-cors"Tb4b4b4, Ta5d6ff"same-origin"Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3destinations Tff7b72= Tb4b4b4[Ta5d6ff""Tb4b4b4, Ta5d6ff"document"Tb4b4b4, Ta5d6ff"script"Tb4b4b4, Ta5d6ff"style"Tb4b4b4, Ta5d6ff"image"Tb4b4b4, Ta5d6ff"worker"Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3paths Tff7b72= Tb4b4b4[

Ta5d6ff"/"Tb4b4b4,

Ta5d6ff"/index.html"Tb4b4b4,

Ta5d6ff"/assets/x.js"Tb4b4b4,

Ta5d6ff"/assets/vendor/a.css"Tb4b4b4,

Ta5d6ff"/boot-theme.js"Tb4b4b4,

Ta5d6ff"/manifest.json"Tb4b4b4,

Ta5d6ff"/favicons/favicon-512x512.png"Tb4b4b4,

Ta5d6ff"/favicon.ico"Tb4b4b4,

Ta5d6ff"/api/v1/status"Tb4b4b4,

Ta5d6ff"/api/v1/config"Tb4b4b4,

Ta5d6ff"/ws"Tb4b4b4,

Ta5d6ff"/ws/telephone/audio"Tb4b4b4,

Ta5d6ff"/service-worker.js"Tb4b4b4,

Ta5d6ff"/vendor/micron.wasm"Tb4b4b4,

Ta5d6ff"/meshchatx-docs/en/getting-started.md"Tb4b4b4,

Ta5d6ff"/#/messages"Tb4b4b4,

Ta5d6ff"//evil.example/assets/x.js"Tb4b4b4,

Ta5d6ff"/assets"Tb4b4b4,

Ta5d6ff"/api"Tb4b4b4,

Ta5d6ff"/API/v1/status"Tb4b4b4,

Ta5d6ff"/assets/../api/v1/status"Tb4b4b4,

Tb4b4b4]Tb4b4b4;

Tff7b72for Tb4b4b4(Tff7b72let Te6edf3i Tff7b72= T79c0ff0Tb4b4b4; Te6edf3i Tff7b72< T79c0ff400Tb4b4b4; Te6edf3iTff7b72++Tb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3pathname Tff7b72= Te6edf3pathsTb4b4b4[Tffa657MathTb4b4b4.Te6edf3floorTb4b4b4(Te6edf3randTb4b4b4(Tb4b4b4) Tff7b72* Te6edf3pathsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3method Tff7b72= Te6edf3methodsTb4b4b4[Tffa657MathTb4b4b4.Te6edf3floorTb4b4b4(Te6edf3randTb4b4b4(Tb4b4b4) Tff7b72* Te6edf3methodsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3mode Tff7b72= Te6edf3modesTb4b4b4[Tffa657MathTb4b4b4.Te6edf3floorTb4b4b4(Te6edf3randTb4b4b4(Tb4b4b4) Tff7b72* Te6edf3modesTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3destination Tff7b72= Te6edf3destinationsTb4b4b4[Tffa657MathTb4b4b4.Te6edf3floorTb4b4b4(Te6edf3randTb4b4b4(Tb4b4b4) Tff7b72* Te6edf3destinationsTb4b4b4.Te6edf3lengthTb4b4b4)Tb4b4b4]Tb4b4b4;

Tff7b72const Te6edf3accept Tff7b72= Te6edf3randTb4b4b4(Tb4b4b4) Tff7b72> T79c0ff0.7 Tff7b72? Ta5d6ff"text/html" Tff7b72: Ta5d6ff"application/json"Tb4b4b4;

Tff7b72let Te6edf3urlTb4b4b4;

Tff7b72try Tb4b4b4{

Te6edf3url Tff7b72= Tff7b72new Te6edf3URLTb4b4b4(Te6edf3pathnameTb4b4b4, Ta5d6ff"https://127.0.0.1"Tb4b4b4)Tb4b4b4;

Tb4b4b4} Tff7b72catch Tb4b4b4{

Tff7b72continueTb4b4b4;

Tb4b4b4}

Tff7b72const Te6edf3request Tff7b72= Te6edf3reqTb4b4b4(Te6edf3urlTb4b4b4.Te6edf3hrefTb4b4b4, Tb4b4b4{

Te6edf3methodTb4b4b4,

Te6edf3modeTb4b4b4,

Te6edf3destinationTb4b4b4,

Te6edf3headersTff7b72: Tb4b4b4{ Te6edf3accept Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3assertClassifyMatchesOracleTb4b4b4(Te6edf3requestTb4b4b4, Te6edf3urlTb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────