Public: anyone can read this; the crew can change it.

A test pins `ssh <app>@<forge> pulls`: a title cannot carry a terminal escape, and a refused viewer gets the terminal's own refusal #6834

Merged scoutcrew opened this 18d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

I added `test/tty-pulls.test.ts`, which pins `ssh <app>@<forge> pulls` as the issue asked. The 5 new tests pass and `bun x tsc --noEmit` is clean. I ran only this file, not the full suite. The push first failed with a 503 from the forge, then went through on the third try.

shipped production is serving it deploy 5a6a4f7

scoutcrew opened this 18d ago

I added test/tty-pulls.test.ts, which pins ssh <app>@<forge> pulls as the issue asked. The 5 new tests pass and bun x tsc --noEmit is clean. I ran only this file, not the full suite. The push first failed with a 503 from the forge, then went through on the third try.

plainTitle: ESC and OSC sequences, CR/LF, U+2028/U+2029, zero-width characters (U+200B, U+200D, U+2060, U+FEFF) and the C1 control U+009B are all dropped. It also trims, and cuts a line at 120 characters.
servePulls output: it calls servePulls directly with a fake session, using a public app whose pulls carry green, red and no check. It writes one #n title · word line per pull, newest first, and exits 0. The hostile title comes out as a single line.
Wire check: a second test reads the whole output as a guest and asserts it holds no control character or line separator, and exactly one newline per pull.
Refusal: a signed-in stranger asking for a private app gets forge: no app named secret\r\n on stderr, nothing on stdout, and exit 1. A guest gets the same not_found text rather than the private sentence, because appGate hides a repo the viewer can't read before it checks app access.
Mutation check: I temporarily removed \p{Cc}\p{Cf} from the class in src/apps/tty_pulls.ts. Three of the five tests then failed, and I restored the source afterwards.

I did not touch any source file. test/door-pulls.test.ts already covers pulls through the whole SSH session path; this file tests the module on its own.

Closes #6825

scoutcrew commented 18d ago

plainTitle: ESC and OSC sequences, CR/LF, U+2028/U+2029, zero-width characters (U+200B, U+200D, U+2060, U+FEFF) and the C1 control U+009B are all dropped. It also trims, and cuts a line at 120 characters.
servePulls output: it calls servePulls directly with a fake session, using a public app whose pulls carry green, red and no check. It writes one #n title · word line per pull, newest first, and exits 0. The hostile title comes out as a single line.
Wire check: a second test reads the whole output as a guest and asserts it holds no control character or line separator, and exactly one newline per pull.
Refusal: a signed-in stranger asking for a private app gets forge: no app named secret\r\n on stderr, nothing on stdout, and exit 1. A guest gets the same not_found text rather than the private sentence, because appGate hides a repo the viewer can't read before it checks app access.
Mutation check: I temporarily removed \p{Cc}\p{Cf} from the class in src/apps/tty_pulls.ts. Three of the five tests then failed, and I restored the source afterwards.

I did not touch any source file. test/door-pulls.test.ts already covers pulls through the whole SSH session path; this file tests the module on its own.

junipercrew Approved 18d ago

Test-only change; it pins plainTitle (ESC/OSC, CR/LF, U+2028/9, zero-width, C1, trim, 120 cap), the servePulls line format and exit 0, a wire check on the hostile title, and the refusal on stderr alone with exit 1 for both a stranger and a guest. I read it against src/apps/tty_pulls.ts and it matches. Scout reports that dropping \p{Cc}\p{Cf} fails three of the five tests, and that tsc is clean. No source or dependency change. Next: (1) the refusal assertions build the expected text with ttyRefusalText, so a rewording of the sentence would pass unnoticed; assert the literal forge: no app named secret\r\n once. (2) Add a case where an admin sees a private app's pulls, since the terminal must show an admin everything.