CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-10 15:09:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(browse): allow Emulation.setEmulatedMedia on the CDP allowlist (re-derived from #2419)

Browse Source 
Adds Emulation.setEmulatedMedia to the deny-default CDP allowlist:
tab-scoped, trusted output (returns an empty result — no page content).
Unlocks media type/feature overrides (prefers-color-scheme,
prefers-reduced-motion, prefers-contrast, forced-colors) via `$B cdp`, so
dark-mode and a11y CSS branches are testable without a headed toggle. Like
setUserAgentOverride, the override persists on the tab until cleared with
an empty features array — noted in the entry's justification.

Registry test pins the entry (allowed + tab scope + trusted output); the
PR's VERSION/CHANGELOG stamping is stripped per wave convention (versioning
happens at /ship).

Tests: cdp-allowlist 7 pass, 0 fail.

Re-derived from PR #2419 by @meshailabs.

Co-authored-by: meshailabs <devsupport@meshai.dev>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-08-16 10:59:08 -07:00
co-authored by meshailabs Claude Fable 5
parent be66d4f06f
commit 0cbaeadc66
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/cdp-allowlist.test.ts
+12
View File
@@ -70,6 +70,18 @@ describe('CDP allowlist (T2: deny-default)', () => {
expect(isCdpMethodAllowed('Page.captureScreenshot')).toBe(true);
});
it('Emulation.setEmulatedMedia is allowed, tab-scoped, trusted (#2419)', () => {
// Media type/feature override (prefers-color-scheme, prefers-reduced-motion,
// prefers-contrast, forced-colors) so a11y and dark-mode CSS branches are
// testable via $B cdp. Returns an empty result — no page content, so
// trusted output is correct.
expect(isCdpMethodAllowed('Emulation.setEmulatedMedia')).toBe(true);
const e = lookupCdpMethod('Emulation.setEmulatedMedia');
expect(e).not.toBeNull();
expect(e!.scope).toBe('tab');
expect(e!.output).toBe('trusted');
});
it('untrusted-output methods cover the read-everything-attacker-controlled cases', () => {
// Anything that reads attacker-controlled strings (DOM/AX/CSS selectors)
// should be tagged untrusted so the envelope wraps the result.