diff options
Diffstat (limited to 'packages/meshbay-node/tests/test_security_regressions.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_security_regressions.py | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py index a229153..d6ecb71 100644 --- a/packages/meshbay-node/tests/test_security_regressions.py +++ b/packages/meshbay-node/tests/test_security_regressions.py @@ -1,10 +1,10 @@ """ Phase 11.5 security regression tests. -Each test here encodes a finding from `second-review.md`. They are negative tests: -they assert that an attack does NOT work. The pre-11.5 code passed 209 feature -tests while every one of these attacks succeeded — the suite only ever exercised -happy paths, never an authorization boundary. +Each test here encodes a finding from `docs/MESHBAY_DESIGN.md` §13.3. They are +negative tests: they assert that an attack does NOT work. The pre-11.5 code +passed 209 feature tests while every one of these attacks succeeded — the suite +only ever exercised happy paths, never an authorization boundary. If one of these starts failing, a fix has been reverted. Do not "fix" the test. """ @@ -447,7 +447,7 @@ def test_daemon_sets_no_global_chat_store(tmp_path): def test_no_member_can_hand_the_node_key_material(tmp_path): """ - C5b, strengthened by the invite redesign (docs/invite-pairing-v1.md). + C5b, strengthened by the invite redesign (docs/MESHBAY_DESIGN.md §3.4). This test used to assert that `gek_bundle_store` answered with an admin challenge and stored nothing without an operator signature. The message is now @@ -818,7 +818,7 @@ def test_node_control_api_serves_no_html(): H2 was stored XSS in the server-rendered admin dashboard: a member-chosen filename, or a hub-supplied username, landed in an HTML page on the operator's machine unescaped. That dashboard is gone - (docs/refactor-node-ui.md phase 5) — the control API is JSON only, so there + (docs/MESHBAY_DESIGN.md §6.7) — the control API is JSON only, so there is no server-side template to inject into. The Node page that replaced it ships in the desktop client and escapes by default (Preact). |