tegwick
ccf46d8c59
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13590-a16f-7f60-be60-fd71627bc99d
37 lines
2.2 KiB
JavaScript
37 lines
2.2 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {validateJob,trial} from '../src/protocol.mjs';
|
|
import {publicAddress,startProxy} from '../src/proxy.mjs';
|
|
import http from 'node:http';
|
|
|
|
const fixture='http://127.0.0.1:9099/';
|
|
const valid=input=>validateJob(input,['http://127.0.0.1:9099'],fixture);
|
|
test('validated contract requires explicit protocol, allowed origin, bounded input and assertions',()=>{
|
|
assert.equal(valid(trial).viewports.length,2);
|
|
for(const patch of [
|
|
{api_version:'2'},{target:'file:///etc/passwd'},{target:'http://127.0.0.1:1/'},
|
|
{target:fixture+'?token=secret'},{timeout_ms:120001},{steps:[{action:'press',key:'Enter'}]},
|
|
{steps:[{action:'eval',value:'process.exit()'}]},{viewports:[{name:'../x',width:390,height:844}]},
|
|
{steps:[{action:'screenshot',name:'../../receipt'}]}, {storageState:{}},
|
|
])assert.throws(()=>valid({...trial,...patch}));
|
|
});
|
|
test('network gate denies non-public addresses unless explicitly granted',()=>{
|
|
for(const ip of ['127.0.0.1','169.254.169.254','10.0.0.1','172.17.0.1','192.168.1.1','100.64.0.1','::1','::ffff:127.0.0.1','fe80::1','fc00::1'])assert.equal(publicAddress(ip),false,ip);
|
|
for(const ip of ['93.184.216.34','2606:4700:4700::1111'])assert.equal(publicAddress(ip),true,ip);
|
|
});
|
|
test('proxy pins DNS and denies unlisted origins and private addresses before connection',async()=>{
|
|
let requests=0;
|
|
const target=http.createServer((req,res)=>{requests++;res.end('ok');});
|
|
await new Promise(r=>target.listen(0,'127.0.0.1',r));
|
|
const url=`http://127.0.0.1:${target.address().port}`;
|
|
const blocked=await startProxy([url],[]);
|
|
const allowed=await startProxy([url],[url]);
|
|
function request(proxy,path){return new Promise((resolve,reject)=>{
|
|
const req=http.get(proxy,{path},res=>{res.resume();res.on('end',()=>resolve(res.statusCode));});req.on('error',reject);
|
|
});}
|
|
try{
|
|
assert.equal(await request(blocked.url,url+'/'),403);assert.equal(requests,0);
|
|
assert.equal(await request(allowed.url,'http://127.0.0.1:1/'),403);assert.equal(requests,0);
|
|
assert.equal(await request(allowed.url,url+'/'),200);assert.equal(requests,1);
|
|
}finally{await blocked.close();await allowed.close();await new Promise(r=>target.close(r));}
|
|
});
|