shadowdaoandClaude Opus 4.8
591a51dcc2
An adversarial pass found 5 Critical XSS sinks where props declared number/enum in TypeScript were interpolated raw into exported HTML attribute values, trusting the type — but nothing enforces it at runtime (AI update_props only validates node_id; deserialized saved state is untyped JSON). Fixed all 5 (NumberCounter data-target, StarRating aria-label, FormContainer method, ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive audit of every attribute-value interpolation across src/components: a JS-source injection into ContentSlider's inline setInterval script, a prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup, TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue primitives. Every fix is TDD'd: a malicious-value test reproduces the raw injection against the pre-fix code, then passes after the fix. 502 tests green (npx vitest run), tsc + vite build green (npm run build). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
2.3 KiB
TypeScript
59 lines
2.3 KiB
TypeScript
import { describe, test, expect } from 'vitest';
|
|
import { Heading } from './Heading';
|
|
|
|
const toHtml = (Heading as any).toHtml;
|
|
|
|
describe('Heading.toHtml level allowlist (adversarial re-review, same class as C1)', () => {
|
|
test('a malicious level value clamps to h2 -- no injected <img>, no broken-out tag', () => {
|
|
const { html } = toHtml({ text: 'x', level: 'h2><img src=x onerror=alert(1)' }, '');
|
|
expect(html).not.toContain('<img');
|
|
expect(html).not.toContain('onerror');
|
|
expect(html.startsWith('<h2')).toBe(true);
|
|
expect(html.endsWith('</h2>')).toBe(true);
|
|
});
|
|
|
|
test('a numeric out-of-range level (99) clamps to h2', () => {
|
|
const { html } = toHtml({ text: 'x', level: 99 as any }, '');
|
|
expect(html.startsWith('<h2')).toBe(true);
|
|
expect(html.endsWith('</h2>')).toBe(true);
|
|
});
|
|
|
|
test('a non-heading string level clamps to h2', () => {
|
|
const { html } = toHtml({ text: 'x', level: 'script' as any }, '');
|
|
expect(html.startsWith('<h2')).toBe(true);
|
|
expect(html).not.toContain('<script');
|
|
});
|
|
|
|
test('a normal valid level (h4) still emits <h4', () => {
|
|
const { html } = toHtml({ text: 'x', level: 'h4' }, '');
|
|
expect(html).toContain('<h4');
|
|
expect(html).toContain('</h4>');
|
|
});
|
|
|
|
test('all valid levels h1-h6 still work', () => {
|
|
for (const level of ['h1', 'h2', 'h3', 'h4', 'h5', 'h6']) {
|
|
const { html } = toHtml({ text: 'x', level }, '');
|
|
expect(html.startsWith(`<${level}`)).toBe(true);
|
|
expect(html.endsWith(`</${level}>`)).toBe(true);
|
|
}
|
|
});
|
|
});
|
|
|
|
describe('Heading.toHtml text escaping (attacker-controlled `text` prop)', () => {
|
|
test('a tag-breakout attempt in text is neutralized (no injected element)', () => {
|
|
const { html } = toHtml({ text: '</h2><img src=x onerror=alert(1)>', level: 'h2' }, '');
|
|
expect(html).not.toContain('<img');
|
|
expect(html).toContain('<img');
|
|
});
|
|
|
|
test('ampersand is escaped for well-formed text content (consistency with escapeHtml)', () => {
|
|
const { html } = toHtml({ text: 'Fish & Chips', level: 'h2' }, '');
|
|
expect(html).toContain('Fish & Chips');
|
|
});
|
|
|
|
test('a normal text value still renders unchanged', () => {
|
|
const { html } = toHtml({ text: 'Hello world', level: 'h2' }, '');
|
|
expect(html).toBe('<h2>Hello world</h2>');
|
|
});
|
|
});
|