shadowdaoandClaude Opus 4.8
591a51dcc2
An adversarial pass found 5 Critical XSS sinks where props declared number/enum in TypeScript were interpolated raw into exported HTML attribute values, trusting the type — but nothing enforces it at runtime (AI update_props only validates node_id; deserialized saved state is untyped JSON). Fixed all 5 (NumberCounter data-target, StarRating aria-label, FormContainer method, ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive audit of every attribute-value interpolation across src/components: a JS-source injection into ContentSlider's inline setInterval script, a prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup, TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue primitives. Every fix is TDD'd: a malicious-value test reproduces the raw injection against the pre-fix code, then passes after the fix. 502 tests green (npx vitest run), tsc + vite build green (npm run build). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
78 lines
3.5 KiB
TypeScript
78 lines
3.5 KiB
TypeScript
import { describe, test, expect } from 'vitest';
|
|
import { StarRating } from './StarRating';
|
|
|
|
const toHtml = (StarRating as any).toHtml;
|
|
|
|
describe('StarRating.toHtml accessibility (F2.2)', () => {
|
|
test('wrapper has role="img" and a "Rating: N out of maxStars" aria-label', () => {
|
|
const { html } = toHtml({ rating: 4.5, maxStars: 5 }, '');
|
|
expect(html).toMatch(/<span role="img" aria-label="Rating: 4\.5 out of 5"/);
|
|
});
|
|
|
|
test('individual star glyphs are aria-hidden', () => {
|
|
const { html } = toHtml({ rating: 3, maxStars: 5 }, '');
|
|
const glyphs = html.match(/<i class="fa fa-star"[^>]*>/g) || [];
|
|
expect(glyphs.length).toBeGreaterThan(0);
|
|
glyphs.forEach((tag: string) => expect(tag).toContain('aria-hidden="true"'));
|
|
});
|
|
|
|
test('respects custom maxStars in the aria-label', () => {
|
|
const { html } = toHtml({ rating: 2, maxStars: 10 }, '');
|
|
expect(html).toContain('aria-label="Rating: 2 out of 10"');
|
|
});
|
|
});
|
|
|
|
describe('StarRating.toHtml XSS hardening (filledColor/emptyColor/size into style=)', () => {
|
|
test('a filledColor value containing a quote breakout is neutralized', () => {
|
|
const malicious = '#f00" onmouseover="alert(1)';
|
|
const { html } = toHtml({ rating: 3, maxStars: 5, filledColor: malicious }, '');
|
|
expect(html).not.toMatch(/style="[^"]*"[^>]*onmouseover/);
|
|
});
|
|
|
|
test('a size value containing </style><script> is neutralized', () => {
|
|
const malicious = '24px</style><script>alert(1)</script>';
|
|
const { html } = toHtml({ rating: 3, maxStars: 5, size: malicious }, '');
|
|
expect(html).not.toContain('<script>alert(1)</script>');
|
|
});
|
|
|
|
test('a normal filled color still renders', () => {
|
|
const { html } = toHtml({ rating: 5, maxStars: 5, filledColor: '#ff9900' }, '');
|
|
expect(html).toContain('color:#ff9900');
|
|
});
|
|
});
|
|
|
|
describe('StarRating.toHtml XSS hardening (rating/maxStars into aria-label, F2.2 CONFIRMED sink)', () => {
|
|
test('a maxStars value with an attribute-breakout string is neutralized in aria-label', () => {
|
|
const malicious = '5" onmouseover="alert(1)';
|
|
const { html } = toHtml({ rating: 3, maxStars: malicious as any }, '');
|
|
expect(html).not.toMatch(/onmouseover/);
|
|
expect(html).not.toMatch(/aria-label="Rating: 3 out of 5" onmouseover/);
|
|
});
|
|
|
|
test('a rating value with an attribute-breakout string is neutralized in aria-label', () => {
|
|
const malicious = '4.5" onmouseover="alert(1)';
|
|
const { html } = toHtml({ rating: malicious as any, maxStars: 5 }, '');
|
|
expect(html).not.toMatch(/onmouseover/);
|
|
});
|
|
|
|
test('a non-numeric maxStars does not blow up the star loop (no NaN glyph count, no huge output)', () => {
|
|
const malicious = '5" onmouseover="alert(1)';
|
|
const { html } = toHtml({ rating: 3, maxStars: malicious as any }, '');
|
|
const glyphs = html.match(/<i class="fa fa-star"/g) || [];
|
|
// Falls back to a sane default star count rather than looping 0 or NaN times.
|
|
expect(glyphs.length).toBeGreaterThan(0);
|
|
expect(glyphs.length).toBeLessThanOrEqual(50);
|
|
});
|
|
|
|
test('an absurdly large maxStars is clamped to a sane maximum instead of looping unboundedly', () => {
|
|
const { html } = toHtml({ rating: 3, maxStars: 1e9 as any }, '');
|
|
const glyphs = html.match(/<i class="fa fa-star"/g) || [];
|
|
expect(glyphs.length).toBeLessThanOrEqual(50);
|
|
});
|
|
|
|
test('normal numeric rating/maxStars still render the expected aria-label', () => {
|
|
const { html } = toHtml({ rating: 4.5, maxStars: 5 }, '');
|
|
expect(html).toMatch(/<span role="img" aria-label="Rating: 4\.5 out of 5"/);
|
|
});
|
|
});
|