Public: anyone can read this; the crew can change it.
A test pins the social cards: a private repository's card is a 404 to a guest, and a title's markup is escaped in the SVG #6838
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/6828-a-test-pins-the-social-cards-a-private-r → main 1 commit fork
1 file
changed +138
−0
test/og-cards.test.ts added +138
| @@ -0,0 +1,138 @@ | ||
| 1 | import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test"; | |
| 2 | import { mkdtemp, rm } from "node:fs/promises"; | |
| 3 | import { tmpdir } from "node:os"; | |
| 4 | import { join } from "node:path"; | |
| 5 | import { createApp as createForge, type App } from "../src/app.ts"; | |
| 6 | import { createRepo } from "../src/actions/repos.ts"; | |
| 7 | import { createApp } from "../src/core/apps.ts"; | |
| 8 | import { createIssue } from "../src/core/issues.ts"; | |
| 9 | import { getRepo } from "../src/core/repos.ts"; | |
| 10 | import { createRun } from "../src/core/runs.ts"; | |
| 11 | import { createUser } from "../src/core/users.ts"; | |
| 12 | import { serve, type Servers } from "../src/http/server.ts"; | |
| 13 | ||
| 14 | setDefaultTimeout(30_000); | |
| 15 | ||
| 16 | const HOSTILE = `<script>alert(1)</script> & "q"`; | |
| 17 | ||
| 18 | describe("social cards: public refs, private refs, hostile titles", () => { | |
| 19 | let dataDir: string; | |
| 20 | let app: App; | |
| 21 | let servers: Servers; | |
| 22 | let runId = ""; | |
| 23 | ||
| 24 | beforeAll(async () => { | |
| 25 | dataDir = await mkdtemp(join(tmpdir(), "forge-og-cards-")); | |
| 26 | app = createForge({ dataDir, port: 0 }); | |
| 27 | servers = await serve(app); | |
| 28 | const u = await createUser(app.db, { | |
| 29 | origin: "seed", | |
| 30 | trusted: true, | |
| 31 | username: "alice", | |
| 32 | email: "[email protected]", | |
| 33 | password: "alice-passphrase", | |
| 34 | adminIfFirst: true, | |
| 35 | }); | |
| 36 | if (!u.ok) throw new Error(u.error); | |
| 37 | for (const [name, visibility] of [ | |
| 38 | ["open", "public"], | |
| 39 | ["vault", "private"], | |
| 40 | ] as const) { | |
| 41 | const made = await createRepo(app, u.value, { name, visibility }); | |
| 42 | if (!made.ok) throw new Error(String(made.error)); | |
| 43 | } | |
| 44 | const open = getRepo(app.db, "alice", "open")!; | |
| 45 | const vault = getRepo(app.db, "alice", "vault")!; | |
| 46 | const app1 = createApp(app.db, { repoId: open.id, slug: "open-app", access: "public" }); | |
| 47 | if (!app1.ok) throw new Error(app1.error); | |
| 48 | const mk = (repoId: string, title: string, kind: "issue" | "pull") => { | |
| 49 | const i = createIssue(app.db, { repoId, authorId: u.value.id, title, kind }); | |
| 50 | if (!i.ok) throw new Error(String(i.error)); | |
| 51 | if (kind === "pull") | |
| 52 | app.db | |
| 53 | .query( | |
| 54 | `INSERT INTO pull (issue_id, base_branch, head_branch, base_oid, head_oid, head_repo_id) | |
| 55 | VALUES (?1, 'main', 'topic', '', '', ?2)`, | |
| 56 | ) | |
| 57 | .run(i.value.id, repoId); | |
| 58 | }; | |
| 59 | mk(open.id, HOSTILE, "issue"); // #1 | |
| 60 | mk(open.id, "A public pull", "pull"); // #2 | |
| 61 | mk(vault.id, "Secret issue", "issue"); // #1 | |
| 62 | mk(vault.id, "Secret pull", "pull"); // #2 | |
| 63 | runId = createRun(app.db, { repoId: open.id, kind: "agent", summary: "did a thing" }).id; | |
| 64 | }, 60_000); | |
| 65 | ||
| 66 | afterAll(async () => { | |
| 67 | await servers.stop(); | |
| 68 | await rm(dataDir, { recursive: true, force: true }); | |
| 69 | }, 30_000); | |
| 70 | ||
| 71 | const get = (path: string) => fetch(servers.url + path); | |
| 72 | ||
| 73 | test("each kind answers 200 svg with the security headers", async () => { | |
| 74 | const refs: Record<string, string> = { | |
| 75 | repo: "alice~open", | |
| 76 | app: "open-app", | |
| 77 | issue: "alice~open~1", | |
| 78 | pull: "alice~open~2", | |
| 79 | run: `alice~open~${runId}`, | |
| 80 | map: "alice~open", | |
| 81 | }; | |
| 82 | for (const [kind, ref] of Object.entries(refs)) { | |
| 83 | const res = await get(`/og/${kind}/${ref}.svg`); | |
| 84 | expect(res.status, kind).toBe(200); | |
| 85 | expect(res.headers.get("content-type"), kind).toContain("image/svg+xml"); | |
| 86 | expect(res.headers.get("x-content-type-options"), kind).toBe("nosniff"); | |
| 87 | expect(res.headers.get("referrer-policy"), kind).toBeTruthy(); | |
| 88 | expect(res.headers.get("content-security-policy"), kind).toContain("default-src 'none'"); | |
| 89 | expect(await res.text(), kind).toStartWith("<svg"); | |
| 90 | } | |
| 91 | }); | |
| 92 | ||
| 93 | test("a private repository's issue and pull are the same 404 as a missing ref", async () => { | |
| 94 | const missing = await get("/og/issue/alice~vault~99.svg"); | |
| 95 | expect(missing.status).toBe(404); | |
| 96 | const missingBody = await missing.text(); | |
| 97 | for (const ref of ["issue/alice~vault~1", "pull/alice~vault~2"]) { | |
| 98 | const res = await get(`/og/${ref}.svg`); | |
| 99 | expect(res.status, ref).toBe(404); | |
| 100 | const body = await res.text(); | |
| 101 | expect(body, ref).toBe(missingBody); | |
| 102 | expect(body).not.toContain("Secret"); | |
| 103 | } | |
| 104 | const missingPull = await (await get("/og/pull/alice~vault~99.svg")).text(); | |
| 105 | expect(await (await get("/og/pull/alice~vault~2.svg")).text()).toBe(missingPull); | |
| 106 | }); | |
| 107 | ||
| 108 | test("a stranger's session gets the same 404", async () => { | |
| 109 | const s = await createUser(app.db, { | |
| 110 | origin: "seed", | |
| 111 | trusted: true, | |
| 112 | username: "mallory", | |
| 113 | email: "[email protected]", | |
| 114 | password: "mallory-passphrase", | |
| 115 | }); | |
| 116 | if (!s.ok) throw new Error(s.error); | |
| 117 | const signin = await fetch(`${servers.url}/signin`, { | |
| 118 | method: "POST", | |
| 119 | body: new URLSearchParams({ username: "mallory", password: "mallory-passphrase" }), | |
| 120 | redirect: "manual", | |
| 121 | }); | |
| 122 | const cookie = (signin.headers.get("set-cookie") ?? "").split(";")[0]!; | |
| 123 | expect(cookie).not.toBe(""); | |
| 124 | for (const ref of ["issue/alice~vault~1", "pull/alice~vault~2"]) { | |
| 125 | const res = await fetch(`${servers.url}/og/${ref}.svg`, { headers: { cookie } }); | |
| 126 | expect(res.status, ref).toBe(404); | |
| 127 | expect(await res.text()).not.toContain("Secret"); | |
| 128 | } | |
| 129 | }); | |
| 130 | ||
| 131 | test("a title's markup is escaped in the SVG", async () => { | |
| 132 | const res = await get("/og/issue/alice~open~1.svg"); | |
| 133 | const svg = await res.text(); | |
| 134 | expect(svg).not.toContain("<script"); | |
| 135 | expect(svg).toContain("<script>alert(1)</scrip"); | |
| 136 | expect(svg).toContain("& "q""); | |
| 137 | }); | |
| 138 | }); |
new above
offline