CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-22 04:40:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: remove prompt-injection ML classifier

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sinabina
2026-07-21 14:40:31 -07:00
co-authored by Claude Opus 4.8
parent d596232248
commit b6a007a7e3
25 changed files with 12 additions and 3126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/adversarial-security.test.ts
+2 -13
View File
@@ -1,8 +1,7 @@
/**
* Adversarial security tests — XSS and boundary-check hardening
* Adversarial security tests — boundary-check hardening
*
* Test 19: Sidepanel escapes entry.command in activity feed (prevents XSS)
* Test 20: Freeze hook uses trailing slash in boundary check (prevents prefix collision)
* Freeze hook uses trailing slash in boundary check (prevents prefix collision)
*/
import { describe, test, expect } from 'bun:test';
@@ -10,16 +9,6 @@ import * as fs from 'fs';
import * as path from 'path';
describe('Adversarial security', () => {
test('sidepanel escapes entry.command in activity feed', () => {
const source = fs.readFileSync(
path.join(import.meta.dir, '../../extension/sidepanel.js'),
'utf-8',
);
// entry.command must be wrapped in escapeHtml() to prevent XSS injection
// via crafted command names in the activity feed
expect(source).toContain('escapeHtml(entry.command');
});
test('freeze hook uses trailing slash in boundary check', () => {
const source = fs.readFileSync(
path.join(import.meta.dir, '../../freeze/bin/check-freeze.sh'),