CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-16 01:45:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(design): dump hygiene covers CSS URLs, srcdoc, and handlers; dumps persist owner-only; ignore prose treats repo config as evidence

Browse Source 
- The dump script cuts query strings from CSS url() in style attributes,
  <style> nodes, and the inlined stylesheets (signed asset URLs), empties
  srcdoc, and covers background and xlink:href.
- Persisted dumps are chmod 600; MEDIUM redaction findings persist (an
  authenticated page shows emails) and the prose says so; earlier runs'
  dumps are swept before the first dump of a run unless --keep-dom.
- The Aside dump prose asks for `'` in a pasted URL to be percent-encoded
  (a bare single quote would end the script) and never to paste an unread
  URL.
- Repo-config ignores are evidence, not settled decisions, in /review,
  /ship, and design-review's probe prose; the scan JSON's text fields are
  named as untrusted.
- design-html's skeleton ceiling is re-measured (54,545); ship goldens
  refreshed for the checklist prose.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-09-08 18:33:22 +00:00
co-authored by Claude Fable 5.1
parent cb9ba7a3e2
commit fb8c64b20c
13 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/dom-dump-hygiene.test.ts
+8 -1
View File
@@ -40,7 +40,7 @@ describe.skipIf(!BROWSE || !POSIX || !OPTED_IN)('lib/dom-dump.js in a real DOM (
},
});
const big = 'data:image/png;base64,' + 'A'.repeat(1500);
fs.writeFileSync(path.join(site, 'styles.css'), '.hero { background: linear-gradient(135deg, #6366f1, #8b5cf6); } .x { background-image: url("' + big + '"); }\n');
fs.writeFileSync(path.join(site, 'styles.css'), '.hero { background: linear-gradient(135deg, #6366f1, #8b5cf6); } .x { background-image: url("' + big + '"); } .y { background: url("/y.png?token=SECRETCSS") }\n');
fs.writeFileSync(path.join(site, 'index.html'), `<!DOCTYPE html><html><head>
<meta charset="utf-8"><meta name="viewport" content="width=device-width"><meta name="description" content="SECRET DESCRIPTION">
<link rel="stylesheet" href="styles.css">
@@ -51,6 +51,7 @@ describe.skipIf(!BROWSE || !POSIX || !OPTED_IN)('lib/dom-dump.js in a real DOM (
<img src="/img.png?sig=SECRETSIG" srcset="/a.png?s=SECRETSET 1x, /b.png?s=SECRETSET2 2x">
<form action="/submit?csrf=SECRETCSRF"><button formaction="/alt?f=SECRETFORM" onclick="track('SECRETHANDLER')">go</button></form>
<template><input value="SECRET TEMPLATE"><a href="/t?x=SECRETTPL">t</a></template><noscript><img src="/px.gif?id=SECRETNOSCRIPT"></noscript>
<div style="background-image:url(https://cdn.example/x.png?X-Amz-Signature=SECRETSIG2)">s</div><iframe srcdoc="<input value='SECRETSRCDOC'>"></iframe><svg><use xlink:href="/s.svg?v=SECRETXLINK"></use></svg>
<style>.inline { background: url("${big}") }</style>
<div data-long="${'L'.repeat(40)}" data-short="ok" title="${big}">x</div>
<img src="${big}">
@@ -102,6 +103,12 @@ describe.skipIf(!BROWSE || !POSIX || !OPTED_IN)('lib/dom-dump.js in a real DOM (
expect(html).not.toContain('SECRETTPL');
expect(html).not.toContain('SECRETNOSCRIPT');
expect(html).not.toMatch(/<template|<noscript/);
expect(html).not.toContain('SECRETSIG2');
expect(html).toContain('url(https://cdn.example/x.png)');
expect(html).not.toContain('SECRETCSS');
expect(html).toContain('url("/y.png")');
expect(html).not.toContain('SECRETSRCDOC');
expect(html).not.toContain('SECRETXLINK');
expect(html).toContain('srcset="/a.png 1x, /b.png 2x"');
expect(html).not.toContain('L'.repeat(40));
expect(html).toContain('data-short="ok"');