shadowdao
591a51dcc2
An adversarial pass found 5 Critical XSS sinks where props declared number/enum in TypeScript were interpolated raw into exported HTML attribute values, trusting the type — but nothing enforces it at runtime (AI update_props only validates node_id; deserialized saved state is untyped JSON). Fixed all 5 (NumberCounter data-target, StarRating aria-label, FormContainer method, ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive audit of every attribute-value interpolation across src/components: a JS-source injection into ContentSlider's inline setInterval script, a prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup, TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue primitives. Every fix is TDD'd: a malicious-value test reproduces the raw injection against the pre-fix code, then passes after the fix. 502 tests green (npx vitest run), tsc + vite build green (npm run build). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
66 lines
3.0 KiB
TypeScript
66 lines
3.0 KiB
TypeScript
import { describe, test, expect } from 'vitest';
|
|
import { TextareaField } from './TextareaField';
|
|
|
|
const toHtml = (TextareaField as any).toHtml;
|
|
|
|
describe('TextareaField.toHtml accessibility (F2.1)', () => {
|
|
test('label for= matches textarea id=', () => {
|
|
const { html } = toHtml({ label: 'Message', name: 'message' }, '');
|
|
const forMatch = html.match(/<label for="([^"]+)"/);
|
|
const idMatch = html.match(/<textarea id="([^"]+)"/);
|
|
expect(forMatch).toBeTruthy();
|
|
expect(idMatch).toBeTruthy();
|
|
expect(forMatch![1]).toBe(idMatch![1]);
|
|
});
|
|
|
|
test('no visible label: textarea gets aria-label from placeholder', () => {
|
|
const { html } = toHtml({ label: '', name: 'notes', placeholder: 'Anything else?' }, '');
|
|
expect(html).not.toContain('<label');
|
|
expect(html).toContain('aria-label="Anything else?"');
|
|
});
|
|
});
|
|
|
|
describe('TextareaField.toHtml deterministic + unique ids (thread node id, resolves id-collision finding)', () => {
|
|
test('label for= still matches textarea id= after threading the node id', () => {
|
|
const { html } = toHtml({ label: 'Message', name: 'message' }, '', 'node-ta1');
|
|
const forMatch = html.match(/<label for="([^"]+)"/);
|
|
const idMatch = html.match(/<textarea id="([^"]+)"/);
|
|
expect(forMatch![1]).toBe(idMatch![1]);
|
|
});
|
|
|
|
test('same node id -> identical output across calls (deterministic, no Math.random)', () => {
|
|
const { html: html1 } = toHtml({ label: 'Message', name: 'message' }, '', 'node-ta1');
|
|
const { html: html2 } = toHtml({ label: 'Message', name: 'message' }, '', 'node-ta1');
|
|
expect(html1).toBe(html2);
|
|
});
|
|
|
|
test('two instances with the SAME default name but different node ids do not collide', () => {
|
|
const { html: html1 } = toHtml({ label: 'Message', name: 'message' }, '', 'node-ta1');
|
|
const { html: html2 } = toHtml({ label: 'Message', name: 'message' }, '', 'node-ta2');
|
|
const id1 = html1.match(/<textarea id="([^"]+)"/)![1];
|
|
const id2 = html2.match(/<textarea id="([^"]+)"/)![1];
|
|
expect(id1).not.toBe(id2);
|
|
});
|
|
|
|
test('no nodeId (legacy 2-arg call): id derivation stays deterministic, not random', () => {
|
|
const { html: html1 } = toHtml({ label: 'Message', name: 'message' }, '');
|
|
const { html: html2 } = toHtml({ label: 'Message', name: 'message' }, '');
|
|
const id1 = html1.match(/<textarea id="([^"]+)"/)![1];
|
|
const id2 = html2.match(/<textarea id="([^"]+)"/)![1];
|
|
expect(id1).toBe(id2);
|
|
});
|
|
});
|
|
|
|
describe('TextareaField.toHtml rows attribute sanitization', () => {
|
|
test('malicious rows value cannot break out of the attribute; falls back to a numeric rows', () => {
|
|
const { html } = toHtml({ label: 'Message', name: 'message', rows: '4"><script>alert(1)</script>' as any }, '');
|
|
expect(html).not.toContain('<script');
|
|
expect(html).toMatch(/rows="\d+"/);
|
|
});
|
|
|
|
test('legitimate numeric rows still passes through unchanged', () => {
|
|
const { html } = toHtml({ label: 'Message', name: 'message', rows: 8 }, '');
|
|
expect(html).toContain('rows="8"');
|
|
});
|
|
});
|