mirror of
https://github.com/garrytan/gstack.git
synced 2026-05-07 14:06:42 +02:00
Garry Tan
dfe946fe64
Community PR #806 by @mr-k-man (security audit round 2, new parts only). - CSS value validation (DANGEROUS_CSS) in cdp-inspector, write-commands, extension inspector - Queue file permissions (0o700/0o600) in cli, server, sidebar-agent - escapeRegExp for frame --url ReDoS fix - Responsive screenshot path validation with validateOutputPath - State load cookie filtering (reject localhost/.internal/metadata cookies) - Session ID format validation in loadSession - /health endpoint: remove currentUrl and currentMessage fields - QueueEntry interface + isValidQueueEntry validator for sidebar-agent - SIGTERM->SIGKILL escalation in timeout handler - Viewport dimension clamping (1-16384), wait timeout clamping (1s-300s) - Cookie domain validation in cookie-import and cookie-import-browser - DocumentFragment-based tab switching (XSS fix in sidepanel) - pollInProgress reentrancy guard for pollChat - toggleClass/injectCSS input validation in extension inspector - Snapshot annotated path validation with realpathSync - 714-line security-audit-r2.test.ts + 33-line learnings-injection.test.ts Co-Authored-By: mr-k-man <mr-k-man@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
34 lines
1.3 KiB
TypeScript
34 lines
1.3 KiB
TypeScript
import { describe, it, expect } from 'bun:test';
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
import { spawnSync } from 'child_process';
|
|
|
|
const SCRIPT_PATH = path.join(import.meta.dir, '../../bin/gstack-learnings-search');
|
|
const SCRIPT = fs.readFileSync(SCRIPT_PATH, 'utf-8');
|
|
const BIN_DIR = path.join(import.meta.dir, '../../bin');
|
|
|
|
describe('gstack-learnings-search injection safety', () => {
|
|
it('must not interpolate variables into JS string literals', () => {
|
|
const jsBlock = SCRIPT.slice(SCRIPT.indexOf('bun -e'));
|
|
expect(jsBlock).not.toMatch(/const \w+ = '\$\{/);
|
|
expect(jsBlock).not.toMatch(/= \$\{[A-Z_]+\};/);
|
|
expect(jsBlock).not.toMatch(/'\$\{CROSS_PROJECT\}'/);
|
|
});
|
|
|
|
it('must use process.env for parameters', () => {
|
|
const jsBlock = SCRIPT.slice(SCRIPT.indexOf('bun -e'));
|
|
expect(jsBlock).toContain('process.env');
|
|
});
|
|
});
|
|
|
|
describe('gstack-learnings-search injection behavioral', () => {
|
|
it('handles single quotes in query safely', () => {
|
|
const result = spawnSync('bash', [
|
|
path.join(BIN_DIR, 'gstack-learnings-search'),
|
|
'--query', "test'; process.exit(99); //",
|
|
'--limit', '1'
|
|
], { encoding: 'utf-8', timeout: 5000, env: { ...process.env, HOME: '/tmp/nonexistent-gstack-test' } });
|
|
expect(result.status).not.toBe(99);
|
|
});
|
|
});
|