69 lines
3.1 KiB
Python
69 lines
3.1 KiB
Python
|
"""Rendering review uses synthetic notes and never accepts private corpus fidelity."""
|
||
|
|
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
import subprocess
|
||
|
|
import sys
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
from coulomb_social.apps.spaces.content import render_markdown
|
||
|
|
from coulomb_social.apps.spaces.rendering_audit import audit_body, review_card
|
||
|
|
|
||
|
|
|
||
|
|
def test_audit_uses_product_renderer_and_reports_custom_tags_attributes_and_schemes():
|
||
|
|
body = ('# Synthetic\n\n<topic>Placeholder</topic><br>Text\n'
|
||
|
|
'<img src="assets/picture.png" onerror="synthetic()">'
|
||
|
|
'<a href="javascript:synthetic()">Unsafe</a>')
|
||
|
|
audit, rendered = audit_body(body)
|
||
|
|
assert rendered == render_markdown(body)
|
||
|
|
assert audit["sanitization_changed_html"]
|
||
|
|
assert audit["markup_changed_by_sanitization"]
|
||
|
|
assert not audit["serialization_only_change"]
|
||
|
|
assert audit["removed_tag_counts"] == {"topic": 1}
|
||
|
|
assert {a["attribute"] for a in audit["removed_attributes"]} == {"onerror", "href"}
|
||
|
|
assert "assets/picture.png" in rendered and "<br>" in rendered
|
||
|
|
assert audit["body_sha256"] == hashlib.sha256(body.encode()).hexdigest()
|
||
|
|
assert not audit["original_bubble_render_compared"]
|
||
|
|
assert not audit["productive_fidelity_accepted"]
|
||
|
|
|
||
|
|
|
||
|
|
def test_serialized_line_break_difference_is_not_reported_as_lost_markup():
|
||
|
|
audit, _ = audit_body("First<br/>Second")
|
||
|
|
assert audit["serialization_only_change"]
|
||
|
|
assert not audit["markup_changed_by_sanitization"]
|
||
|
|
assert not audit["visible_text_changed_by_sanitization"]
|
||
|
|
|
||
|
|
|
||
|
|
def test_review_card_escapes_source_and_blocks_resources_and_interaction():
|
||
|
|
body = '<img src="https://example.invalid/synthetic.png"><script>synthetic()</script>'
|
||
|
|
audit, rendered = audit_body(body)
|
||
|
|
card = review_card("</h1><script>synthetic()</script>", body, rendered, audit,
|
||
|
|
source_id='a/"?b').decode()
|
||
|
|
assert "<script>" not in card
|
||
|
|
assert "<script>" in card
|
||
|
|
assert "default-src 'none'" in card
|
||
|
|
assert "base-uri 'none'" in card and "form-action 'none'" in card
|
||
|
|
assert "<div inert>" in card
|
||
|
|
assert 'https://coulomb.social/pg_chunk/a%2F%22%3Fb' in card
|
||
|
|
|
||
|
|
|
||
|
|
def test_cli_keeps_missing_bodies_and_private_permissions_and_refuses_overwrite(tmp_path):
|
||
|
|
repo = Path(__file__).resolve().parents[1]
|
||
|
|
source = tmp_path / "articles.json"
|
||
|
|
source.write_text(json.dumps({"a": {"content_text": "Synthetic", "nomer_text": "Private"},
|
||
|
|
"b": {"_id": "b"}}))
|
||
|
|
output = tmp_path / "audit"
|
||
|
|
cmd = [sys.executable, str(repo / "scripts/audit-bubble-rendering.py"), str(source),
|
||
|
|
"--output", str(output)]
|
||
|
|
result = subprocess.run(cmd, capture_output=True, text=True)
|
||
|
|
assert result.returncode == 0, result.stderr
|
||
|
|
assert "Private" not in result.stdout
|
||
|
|
report = json.loads((output / "audit.json").read_text())
|
||
|
|
assert len(report["records"]) == 2
|
||
|
|
assert report["records"][1]["status"] == "body_missing"
|
||
|
|
assert (output / "index.html").is_file()
|
||
|
|
assert os.stat(output).st_mode & 0o777 == 0o700
|
||
|
|
assert all(os.stat(p).st_mode & 0o777 == 0o600 for p in output.iterdir())
|
||
|
|
assert subprocess.run(cmd, capture_output=True).returncode == 1
|