diff options
Diffstat (limited to 'packages/meshbay-node/tests/test_security_regressions.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_security_regressions.py | 62 |
1 files changed, 20 insertions, 42 deletions
diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py index 725b800..10182d3 100644 --- a/packages/meshbay-node/tests/test_security_regressions.py +++ b/packages/meshbay-node/tests/test_security_regressions.py @@ -650,56 +650,34 @@ def test_node_admin_ui_requires_token(): assert client.get("/api/status").status_code == 403 assert client.get("/api/status?t=wrong").status_code == 403 - assert client.get("/api/config?t=wrong").status_code == 403 + assert client.get("/api/groups?t=wrong").status_code == 403 assert client.get("/api/status?t=secret-token").status_code == 200 assert client.get( "/api/status", headers={"X-MeshBay-Token": "secret-token"} ).status_code == 200 -def test_admin_ui_escapes_filenames(tmp_path): +def test_node_control_api_serves_no_html(): """ - H2: filenames are chosen by any group member and were rendered into the - localhost admin UI unescaped, giving script execution against an - unauthenticated admin API. - """ - from meshbay_node.ui.app import _render_page - - payload = '<img src=x onerror="fetch(1)">' - index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate()) - index.add_entry(IndexEntry( - id="0" * 64, name=payload, path="", size=1, type="video", added_at=0, - )) - - html = _render_page({ - "status": "running", - "groups_ctx": {"g" * 32: {"index": index, "roots": one_root(tmp_path)}}, - "indexes": {"g" * 32: index}, - }) - - assert payload not in html, "filename rendered unescaped — stored XSS (H2)" - assert "<img" in html, "filename should appear escaped" + H2 was stored XSS in the server-rendered admin dashboard: a member-chosen + filename, or a hub-supplied username, landed in an HTML page on the + operator's machine unescaped. That dashboard is gone + (docs/refactor-node-ui.md phase 5) — the control API is JSON only, so there + is no server-side template to inject into. The Node page that replaced it + ships in the desktop client and escapes by default (Preact). - -def test_admin_ui_escapes_roster_usernames(tmp_path): - """ - H2 again, for the roster: usernames originate at the hub and land on the - operator's own admin page, which can re-key groups and read the audit log. + This locks the removal in: the HTML routes stay 404, and the render helpers + stay deleted so nothing reintroduces a template by importing one. """ - from meshbay_node.ui.app import _render_page + import meshbay_node.ui.app as ui_app + from fastapi.testclient import TestClient - payload = '<img src=x onerror="fetch(1)">' - html = _render_page( - {"status": "running", "groups_ctx": {}, "indexes": {}}, - { - "identities": {"u1": {"user_id": "u1", "username": payload, - "pk_ed25519": "AAA", "pinned_at": "now", - "pinned_via": "code"}}, - "members": [{"group_id": "", "user_id": "u1", "role": "operator", - "status": "active"}], - "invites": [], - }, - ) + app = ui_app.create_ui_app({"status": "running", "groups_ctx": {}, + "indexes": {}, "ui_token": "t"}) + client = TestClient(app) + for path in ("/", "/audit", "/dashboard"): + assert client.get(f"{path}?t=t").status_code == 404, path - assert payload not in html, "username rendered unescaped — stored XSS (H2)" - assert "<img" in html + for gone in ("_render_page", "_render_audit_page", "_render_roster", + "_AUDIT_HTML"): + assert not hasattr(ui_app, gone), f"{gone} came back — HTML surface" |