switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

Feat v0.6.5 renderer pipeline (#40)
All checks were successful
CI/CD / detect-changes (push) Successful in 4s
Details
CI/CD / test-frontend (push) Successful in 6s
Details
CI/CD / test-go-pg (push) Successful in 2m48s
Details
CI/CD / test-sqlite (push) Successful in 2m52s
Details
CI/CD / build-and-deploy (push) Successful in 1m20s
Details

Browse Source 
Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>
This commit was merged in pull request #40.
This commit is contained in:
Jeffrey Smith
2026-03-31 16:37:33 +00:00
committed by xcaliber
parent 36d6158940
commit 81c28a50bf
33 changed files with 2089 additions and 1974 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
packages/icd-test-runner/js/tier-security.js
View File

@@ -543,7 +543,7 @@
await T.test('security', 'input-validation', '[P0] path traversal in surface archive', async function () {
var blob = new Blob([JSON.stringify({ id: '../../../etc/evil', title: 'Path Traversal Test' })], { type: 'application/json' });
try {
var d = await T.apiUpload('/admin/surfaces/install', blob, 'evil.surface');
var d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
T.assert(d._status === 400 || d._status === 409,
'path traversal surface accepted! got ' + d._status);
} catch (e) {
@@ -644,8 +644,8 @@
assertDenied(d._status, 'CRITICAL: team admin can delete users');
});
await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/surfaces/install', async function () {
var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/surfaces/install', {});
await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/packages/install', async function () {
var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/packages/install', {});
if (d._status === 400) return; // bad upload format, not a security issue
assertDenied(d._status, 'team admin can install surfaces');
});