switchboard/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Releases 9 Wiki Activity

V0.7.0 shell contract (#54)
All checks were successful
CI/CD / detect-changes (push) Successful in 3s
Details
CI/CD / test-frontend (push) Successful in 6s
Details
CI/CD / test-sqlite (push) Successful in 2m54s
Details
CI/CD / test-go-pg (push) Successful in 2m55s
Details
CI/CD / build-and-deploy (push) Successful in 1m5s
Details

Browse Source
This commit was merged in pull request #54.
This commit is contained in:
xcaliber
2026-04-01 20:19:45 +00:00
parent 1236220302
commit e916ed41ea
151 changed files with 3250 additions and 684 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
packages/icd-test-runner/js/tier-security.js
View File

@@ -542,16 +542,22 @@
await T.test('security', 'input-validation', '[P0] path traversal in surface archive', async function () {
var blob = new Blob([JSON.stringify({ id: '../../../etc/evil', title: 'Path Traversal Test' })], { type: 'application/json' });
var d;
try {
var d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
T.assert(d._status === 400 || d._status === 409,
d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
T.assert(d._status === 400 || d._status === 422,
'path traversal surface accepted! got ' + d._status);
} catch (e) {
if (e.message.indexOf('502') !== -1) {
throw new Error('INCONCLUSIVE (502): proxy returned 502 on surface upload');
}
T.assert(e.message.indexOf('400') !== -1 || e.message.indexOf('409') !== -1 || e.message.indexOf('415') !== -1,
T.assert(e.message.indexOf('400') !== -1 || e.message.indexOf('422') !== -1 || e.message.indexOf('415') !== -1,
'unexpected error: ' + e.message);
} finally {
// Cleanup: if the evil package was somehow installed, delete it
if (d && (d._status === 200 || d._status === 201) && d.id) {
T.registerCleanup(function () { return T.safeDelete('/admin/packages/' + d.id); });
}
}
});