720 lines
36 KiB
JavaScript
720 lines
36 KiB
JavaScript
/**
|
|
* ICD Test Runner — Security Tier
|
|
* Adversarial red-team tests: auth boundary, cross-tenant isolation,
|
|
* input validation, session security.
|
|
*
|
|
* REQUIRES: fixtures provisioned (3 users + team).
|
|
*
|
|
* Many of these tests are EXPECTED TO FIND REAL BUGS. The test names
|
|
* include severity tags: [P0] = must-fix before 1.0,
|
|
* [P1] = should-fix, [P2] = harden.
|
|
*
|
|
* 502 handling: a 502 means the request never reached the Go backend
|
|
* (Traefik/nginx returned it). This is NOT evidence of a security
|
|
* pass or fail — it is INCONCLUSIVE. Tests that receive 502 throw
|
|
* with a clear "INCONCLUSIVE (502)" prefix so they show as failures
|
|
* without being misread as security breaches.
|
|
*/
|
|
(function () {
|
|
'use strict';
|
|
var T = window.ICD;
|
|
if (!T) return;
|
|
|
|
// ─── Helpers ──────────────────────────────────────────────
|
|
|
|
function randomString(len) {
|
|
var chars = 'abcdefghijklmnopqrstuvwxyz0123456789';
|
|
var s = '';
|
|
for (var i = 0; i < (len || 8); i++) s += chars.charAt(Math.floor(Math.random() * chars.length));
|
|
return s;
|
|
}
|
|
|
|
/**
|
|
* Assert a status code indicates denial (401, 403, 404).
|
|
* 502 = INCONCLUSIVE (proxy ate the request, backend never saw it).
|
|
* Anything else (especially 200/201) = real security failure.
|
|
*/
|
|
function assertDenied(status, label) {
|
|
if (status === 502) {
|
|
throw new Error('INCONCLUSIVE (502): proxy returned 502 before request reached backend — ' + label);
|
|
}
|
|
if (status === 401 || status === 403 || status === 404) return;
|
|
throw new Error(label + ' — got HTTP ' + status);
|
|
}
|
|
|
|
/**
|
|
* Assert a raw fetch() Response is a denial.
|
|
*/
|
|
function assertRawDenied(resp, label) {
|
|
if (resp.status === 502) {
|
|
throw new Error('INCONCLUSIVE (502): proxy returned 502 — ' + label +
|
|
'. Verify Traefik/nginx forwards unauthenticated requests to the Go backend.');
|
|
}
|
|
if (resp.status === 401 || resp.status === 403 || resp.status === 404) return;
|
|
throw new Error(label + ' — got HTTP ' + resp.status);
|
|
}
|
|
|
|
// ─── Main Entry ───────────────────────────────────────────
|
|
|
|
T.runSecurity = async function () {
|
|
if (!T.fixtures.ready) {
|
|
if (typeof UI !== 'undefined') UI.toast('Provision test fixtures first', 'warning');
|
|
return;
|
|
}
|
|
|
|
var testUser = T.getFixtureUser('-user');
|
|
var teamAdmin = T.getFixtureUser('-tadmin');
|
|
var testAdmin = T.getFixtureUser('-admin2');
|
|
var adminToken = await T.getAuthToken();
|
|
|
|
if (!testUser || !testUser.token || !adminToken) {
|
|
T.results.push({ tier: 'security', domain: 'setup', name: 'SKIP — missing tokens', status: 'fail', duration: 0,
|
|
detail: 'Fixture users must be provisioned with valid tokens' });
|
|
return;
|
|
}
|
|
|
|
// ════════════════════════════════════════════════════════
|
|
// 1. AUTH BOUNDARY
|
|
// ════════════════════════════════════════════════════════
|
|
|
|
await T.test('security', 'auth-boundary', '[P0] deactivated user JWT still valid', async function () {
|
|
var tag = 'sec-deact-' + Date.now();
|
|
var pw = 'T3st!Pass' + randomString(6);
|
|
var created = await T.apiPost('/admin/users', {
|
|
username: tag, password: pw, email: tag + '@test.local', role: 'user'
|
|
});
|
|
T.assert(created && created.id, 'failed to create sacrificial user');
|
|
T.registerCleanup(function () { return T.safeDelete('/admin/users/' + created.id); });
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: true });
|
|
var login = await T.publicPost('/auth/login', { login: tag, password: pw });
|
|
T.assert(login.access_token, 'login failed');
|
|
var victimToken = login.access_token;
|
|
|
|
var pre = await T.authFetch(victimToken, 'GET', '/profile');
|
|
T.assertStatus(pre, 200, 'pre-deactivate profile');
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: false });
|
|
|
|
var post = await T.authFetch(victimToken, 'GET', '/profile');
|
|
T.assert(post._status === 401 || post._status === 403,
|
|
'CRITICAL: deactivated user JWT still accepted! got ' + post._status +
|
|
' — middleware does not check is_active in DB');
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P0] demoted admin JWT retains admin access', async function () {
|
|
var tag = 'sec-demote-' + Date.now();
|
|
var pw = 'T3st!Pass' + randomString(6);
|
|
var created = await T.apiPost('/admin/users', {
|
|
username: tag, password: pw, email: tag + '@test.local', role: 'admin'
|
|
});
|
|
T.assert(created && created.id, 'failed to create admin user');
|
|
T.registerCleanup(function () { return T.safeDelete('/admin/users/' + created.id); });
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: true });
|
|
var login = await T.publicPost('/auth/login', { login: tag, password: pw });
|
|
T.assert(login.access_token, 'login failed');
|
|
var adminJwt = login.access_token;
|
|
|
|
var pre = await T.authFetch(adminJwt, 'GET', '/admin/stats');
|
|
T.assertStatus(pre, 200, 'pre-demote admin stats');
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/role', { role: 'user' });
|
|
|
|
var post = await T.authFetch(adminJwt, 'GET', '/admin/stats');
|
|
T.assert(post._status === 403 || post._status === 401,
|
|
'CRITICAL: demoted user JWT still has admin access! got ' + post._status +
|
|
' — role is baked into JWT, not checked against DB');
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P1] refresh token reuse after logout', async function () {
|
|
var tag = 'sec-refresh-' + Date.now();
|
|
var pw = 'T3st!Pass' + randomString(6);
|
|
var created = await T.apiPost('/admin/users', {
|
|
username: tag, password: pw, email: tag + '@test.local', role: 'user'
|
|
});
|
|
T.assert(created && created.id, 'failed to create user');
|
|
T.registerCleanup(function () { return T.safeDelete('/admin/users/' + created.id); });
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: true });
|
|
var login = await T.publicPost('/auth/login', { login: tag, password: pw });
|
|
T.assert(login.refresh_token, 'no refresh token');
|
|
|
|
await T.authFetch(login.access_token, 'POST', '/auth/logout', { refresh_token: login.refresh_token });
|
|
|
|
var reuse = await T.publicPost('/auth/refresh', { refresh_token: login.refresh_token });
|
|
T.assert(reuse._status === 401 || reuse._status === 400,
|
|
'revoked refresh token was accepted! got ' + reuse._status);
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P1] refresh token rotation (old invalid after use)', async function () {
|
|
var tag = 'sec-rotate-' + Date.now();
|
|
var pw = 'T3st!Pass' + randomString(6);
|
|
var created = await T.apiPost('/admin/users', {
|
|
username: tag, password: pw, email: tag + '@test.local', role: 'user'
|
|
});
|
|
T.assert(created && created.id, 'failed to create user');
|
|
T.registerCleanup(function () { return T.safeDelete('/admin/users/' + created.id); });
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: true });
|
|
var login = await T.publicPost('/auth/login', { login: tag, password: pw });
|
|
var rt1 = login.refresh_token;
|
|
|
|
var refreshed = await T.publicPost('/auth/refresh', { refresh_token: rt1 });
|
|
T.assert(refreshed._status === 200 && refreshed.access_token, 'refresh failed');
|
|
|
|
var replay = await T.publicPost('/auth/refresh', { refresh_token: rt1 });
|
|
T.assert(replay._status === 401 || replay._status === 400,
|
|
'rotated-out refresh token still valid! got ' + replay._status);
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P0] tampered JWT payload accepted', async function () {
|
|
var parts = testUser.token.split('.');
|
|
T.assert(parts.length === 3, 'token is not 3-part JWT');
|
|
try {
|
|
var payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
|
|
payload.role = 'admin';
|
|
var faked = btoa(JSON.stringify(payload)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
var forgedToken = parts[0] + '.' + faked + '.' + parts[2];
|
|
var d = await T.authFetch(forgedToken, 'GET', '/admin/stats');
|
|
T.assert(d._status === 401,
|
|
'CRITICAL: tampered JWT was accepted! got ' + d._status);
|
|
} catch (e) {
|
|
if (e.message && e.message.indexOf('CRITICAL') !== -1) throw e;
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P0] JWT alg=none accepted', async function () {
|
|
var header = btoa(JSON.stringify({ alg: 'none', typ: 'JWT' })).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
var payload = btoa(JSON.stringify({
|
|
user_id: testUser.id, email: testUser.username + '@test.local', role: 'admin',
|
|
exp: Math.floor(Date.now() / 1000) + 3600
|
|
})).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
var forged = header + '.' + payload + '.';
|
|
var d = await T.authFetch(forged, 'GET', '/admin/stats');
|
|
T.assert(d._status === 401,
|
|
'CRITICAL: alg=none JWT was accepted! got ' + d._status);
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P1] requests with no user_id context', async function () {
|
|
var d = await T.authFetch('eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiIn0.garbage', 'GET', '/profile');
|
|
T.assert(d._status === 401, 'empty user_id token accepted, got ' + d._status);
|
|
});
|
|
|
|
await T.test('security', 'auth-boundary', '[P1] deactivated user cannot refresh', async function () {
|
|
var tag = 'sec-deact-ref-' + Date.now();
|
|
var pw = 'T3st!Pass' + randomString(6);
|
|
var created = await T.apiPost('/admin/users', {
|
|
username: tag, password: pw, email: tag + '@test.local', role: 'user'
|
|
});
|
|
T.assert(created && created.id, 'failed to create user');
|
|
T.registerCleanup(function () { return T.safeDelete('/admin/users/' + created.id); });
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: true });
|
|
var login = await T.publicPost('/auth/login', { login: tag, password: pw });
|
|
|
|
await T.apiPut('/admin/users/' + created.id + '/active', { is_active: false });
|
|
|
|
var d = await T.publicPost('/auth/refresh', { refresh_token: login.refresh_token });
|
|
T.assert(d._status === 401, 'deactivated user was able to refresh! got ' + d._status);
|
|
});
|
|
|
|
// ════════════════════════════════════════════════════════
|
|
// 2. CROSS-TENANT DATA ACCESS
|
|
// ════════════════════════════════════════════════════════
|
|
|
|
// ── Notes isolation ──
|
|
|
|
var adminNote = null;
|
|
await T.test('security', 'cross-tenant', '[P0] user → read another user\'s note by ID', async function () {
|
|
var d = await T.apiPost('/notes', { title: 'sec-private-' + Date.now(), content: 'SECRET DATA' });
|
|
T.assert(d && d.id, 'note creation failed');
|
|
adminNote = d.id;
|
|
T.registerCleanup(function () { if (adminNote) return T.safeDelete('/notes/' + adminNote); });
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/notes/' + adminNote);
|
|
assertDenied(steal._status, 'user can read another user\'s note');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → update another user\'s note', async function () {
|
|
if (!adminNote) { T.assert(false, 'depends on previous test'); return; }
|
|
var d = await T.authFetch(testUser.token, 'PUT', '/notes/' + adminNote, { title: 'HACKED' });
|
|
assertDenied(d._status, 'user can update another user\'s note');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → delete another user\'s note', async function () {
|
|
if (!adminNote) { T.assert(false, 'depends on previous test'); return; }
|
|
var d = await T.authFetch(testUser.token, 'DELETE', '/notes/' + adminNote);
|
|
assertDenied(d._status, 'user can delete another user\'s note');
|
|
});
|
|
|
|
// ── Memory isolation (no POST /memories — system-extracted only) ──
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → GET /admin/memories/pending (expect deny)', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET', '/admin/memories/pending');
|
|
assertDenied(d._status, 'user can list admin pending memories');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → PUT /memories/:fakeId (expect deny)', async function () {
|
|
var d = await T.authFetch(testUser.token, 'PUT', '/memories/00000000-0000-0000-0000-000000000000', { value: 'HACKED' });
|
|
assertDenied(d._status, 'user can hit PUT /memories with fabricated ID');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → DELETE /memories/:fakeId (expect deny)', async function () {
|
|
var d = await T.authFetch(testUser.token, 'DELETE', '/memories/00000000-0000-0000-0000-000000000000');
|
|
assertDenied(d._status, 'user can hit DELETE /memories with fabricated ID');
|
|
});
|
|
|
|
// ── Channel / message isolation ──
|
|
|
|
var adminChannel = null;
|
|
await T.test('security', 'cross-tenant', '[P0] user → read another user\'s channel messages', async function () {
|
|
var ch = await T.apiPost('/channels', { title: 'sec-private-ch-' + Date.now(), type: 'direct' });
|
|
T.assert(ch && ch.id, 'channel creation failed');
|
|
adminChannel = ch.id;
|
|
T.registerCleanup(function () { if (adminChannel) return T.safeDelete('/channels/' + adminChannel); });
|
|
|
|
await T.apiPost('/channels/' + adminChannel + '/messages', {
|
|
role: 'user', content: 'TOP SECRET MESSAGE'
|
|
});
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/channels/' + adminChannel + '/messages');
|
|
assertDenied(steal._status, 'user can read another user\'s messages');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → POST message to another user\'s channel', async function () {
|
|
if (!adminChannel) { T.assert(false, 'depends on previous test'); return; }
|
|
var d = await T.authFetch(testUser.token, 'POST', '/channels/' + adminChannel + '/messages', {
|
|
role: 'user', content: 'INJECTED'
|
|
});
|
|
assertDenied(d._status, 'user can inject messages into another user\'s channel');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → update another user\'s channel', async function () {
|
|
if (!adminChannel) { T.assert(false, 'depends on previous test'); return; }
|
|
var d = await T.authFetch(testUser.token, 'PUT', '/channels/' + adminChannel, { title: 'HACKED' });
|
|
assertDenied(d._status, 'user can rename another user\'s channel');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → archive another user\'s channel', async function () {
|
|
if (!adminChannel) { T.assert(false, 'depends on previous test'); return; }
|
|
var d = await T.authFetch(testUser.token, 'PUT', '/channels/' + adminChannel, { is_archived: true });
|
|
assertDenied(d._status, 'user can archive another user\'s channel');
|
|
});
|
|
|
|
// ── BYOK config isolation ──
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → enumerate BYOK configs', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET', '/api-configs');
|
|
T.assertStatus(d, 200, 'api-configs');
|
|
var arr = d.data || d.configs || [];
|
|
if (Array.isArray(arr)) {
|
|
arr.forEach(function (cfg) {
|
|
if (cfg.user_id) {
|
|
T.assert(cfg.user_id === testUser.id,
|
|
'BYOK config user_id mismatch — leaking other user\'s config');
|
|
}
|
|
});
|
|
}
|
|
});
|
|
|
|
// ── Task isolation ──
|
|
|
|
var adminTask = null;
|
|
await T.test('security', 'cross-tenant', '[P0] user → read another user\'s task', async function () {
|
|
try {
|
|
var d = await T.apiPost('/tasks', {
|
|
name: 'sec-task-' + Date.now(), task_type: 'scheduled',
|
|
schedule: '0 0 * * *', scope: 'personal',
|
|
prompt: 'test', model: 'test'
|
|
});
|
|
adminTask = (d && d.id) ? d.id : (d && d.task && d.task.id) ? d.task.id : null;
|
|
if (adminTask) T.registerCleanup(function () { return T.safeDelete('/tasks/' + adminTask); });
|
|
} catch (e) { /* may require permissions */ }
|
|
|
|
if (!adminTask) {
|
|
var adm = await T.authFetch(testUser.token, 'GET', '/admin/tasks');
|
|
assertDenied(adm._status, 'user can list admin tasks');
|
|
return;
|
|
}
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/tasks/' + adminTask);
|
|
assertDenied(steal._status, 'user can read another user\'s task');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → delete another user\'s task', async function () {
|
|
if (!adminTask) {
|
|
var d = await T.authFetch(testUser.token, 'DELETE', '/tasks/00000000-0000-0000-0000-000000000000');
|
|
assertDenied(d._status, 'user can hit DELETE /tasks with fabricated ID');
|
|
return;
|
|
}
|
|
var d = await T.authFetch(testUser.token, 'DELETE', '/tasks/' + adminTask);
|
|
assertDenied(d._status, 'user can delete another user\'s task');
|
|
});
|
|
|
|
// ── Workspace isolation ──
|
|
|
|
var adminWs = null;
|
|
await T.test('security', 'cross-tenant', '[P0] user → read another user\'s workspace', async function () {
|
|
try {
|
|
var d = await T.apiPost('/workspaces', {
|
|
name: 'sec-ws-' + Date.now(), owner_type: 'user', owner_id: T.user.id
|
|
});
|
|
if (d && d.id) {
|
|
adminWs = d.id;
|
|
T.registerCleanup(function () { return T.safeDelete('/workspaces/' + adminWs); });
|
|
}
|
|
} catch (e) { /* may fail */ }
|
|
if (!adminWs) return;
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/workspaces/' + adminWs);
|
|
assertDenied(steal._status, 'user can read another user\'s workspace');
|
|
});
|
|
|
|
// ── Cross-team access ──
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → access non-member team providers', async function () {
|
|
var otherTeam = null;
|
|
try {
|
|
var d = await T.apiPost('/admin/teams', { name: 'sec-other-team-' + Date.now(), description: 'isolation test' });
|
|
otherTeam = d.id;
|
|
T.registerCleanup(function () { if (otherTeam) return T.safeDelete('/admin/teams/' + otherTeam); });
|
|
} catch (e) { T.assert(false, 'team creation failed: ' + e.message); return; }
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/teams/' + otherTeam + '/providers');
|
|
assertDenied(steal._status, 'user can list providers for a team they are not in');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → access non-member team personas', async function () {
|
|
var otherTeam = null;
|
|
try {
|
|
var d = await T.apiPost('/admin/teams', { name: 'sec-other-team2-' + Date.now(), description: 'isolation test' });
|
|
otherTeam = d.id;
|
|
T.registerCleanup(function () { if (otherTeam) return T.safeDelete('/admin/teams/' + otherTeam); });
|
|
} catch (e) { T.assert(false, 'team creation failed: ' + e.message); return; }
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/teams/' + otherTeam + '/personas');
|
|
assertDenied(steal._status, 'user can list personas for a team they are not in');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → access non-member team members list', async function () {
|
|
var otherTeam = null;
|
|
try {
|
|
var d = await T.apiPost('/admin/teams', { name: 'sec-other-team3-' + Date.now(), description: 'isolation test' });
|
|
otherTeam = d.id;
|
|
T.registerCleanup(function () { if (otherTeam) return T.safeDelete('/admin/teams/' + otherTeam); });
|
|
} catch (e) { T.assert(false, 'team creation failed: ' + e.message); return; }
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/teams/' + otherTeam + '/members');
|
|
assertDenied(steal._status, 'user can list members of a team they are not in');
|
|
});
|
|
|
|
// ── Project isolation ──
|
|
|
|
var adminProject = null;
|
|
await T.test('security', 'cross-tenant', '[P0] user → read another user\'s personal project', async function () {
|
|
try {
|
|
var d = await T.apiPost('/projects', { name: 'sec-project-' + Date.now(), scope: 'personal' });
|
|
if (d && d.id) {
|
|
adminProject = d.id;
|
|
T.registerCleanup(function () { return T.safeDelete('/projects/' + adminProject); });
|
|
}
|
|
} catch (e) { /* may fail */ }
|
|
if (!adminProject) return;
|
|
|
|
var steal = await T.authFetch(testUser.token, 'GET', '/projects/' + adminProject);
|
|
assertDenied(steal._status, 'user can read another user\'s project');
|
|
});
|
|
|
|
await T.test('security', 'cross-tenant', '[P0] user → delete another user\'s project', async function () {
|
|
if (!adminProject) return;
|
|
var d = await T.authFetch(testUser.token, 'DELETE', '/projects/' + adminProject);
|
|
assertDenied(d._status, 'user can delete another user\'s project');
|
|
});
|
|
|
|
// ── Notification isolation ──
|
|
|
|
await T.test('security', 'cross-tenant', '[P1] user → list only sees own notifications', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET', '/notifications');
|
|
T.assertStatus(d, 200, 'notifications');
|
|
});
|
|
|
|
// ════════════════════════════════════════════════════════
|
|
// 3. INPUT VALIDATION
|
|
// ════════════════════════════════════════════════════════
|
|
|
|
var sqliPayloads = [
|
|
"' OR '1'='1",
|
|
"'; DROP TABLE users; --",
|
|
"' UNION SELECT id, password_hash, email, role, 'x', 'x' FROM users --",
|
|
"1; SELECT pg_sleep(5)--",
|
|
"' OR 1=1--"
|
|
];
|
|
|
|
for (var si = 0; si < sqliPayloads.length; si++) {
|
|
await (async function (payload, idx) {
|
|
await T.test('security', 'input-validation', '[P0] SQLi in notes search (' + (idx + 1) + '/' + sqliPayloads.length + ')', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET',
|
|
'/notes?query=' + encodeURIComponent(payload));
|
|
T.assert(d._status !== 500,
|
|
'SQL injection caused server error (500)! Payload: ' + payload);
|
|
});
|
|
})(sqliPayloads[si], si);
|
|
}
|
|
|
|
await T.test('security', 'input-validation', '[P0] SQLi in channel search', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET',
|
|
'/channels?query=' + encodeURIComponent("' UNION SELECT * FROM users--"));
|
|
T.assert(d._status !== 500, 'SQL injection in channel search caused 500');
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P0] SQLi in admin user search', async function () {
|
|
var d = await T.authFetch(adminToken, 'GET',
|
|
'/admin/users?query=' + encodeURIComponent("' OR '1'='1"));
|
|
T.assert(d._status !== 500, 'SQL injection in admin user search caused 500');
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] XSS in channel title (stored)', async function () {
|
|
var ch = await T.apiPost('/channels', { title: '<script>alert("xss")</script>', type: 'direct' });
|
|
if (ch && ch.id) {
|
|
T.registerCleanup(function () { return T.safeDelete('/channels/' + ch.id); });
|
|
var readBack = await T.apiGet('/channels/' + ch.id);
|
|
T.assert(readBack._status !== 500, 'XSS channel title caused 500');
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] XSS in note content (stored)', async function () {
|
|
var n = await T.apiPost('/notes', { title: 'xss-test', content: '<img src=x onerror=alert(document.cookie)>' });
|
|
if (n && n.id) {
|
|
T.registerCleanup(function () { return T.safeDelete('/notes/' + n.id); });
|
|
var readBack = await T.apiGet('/notes/' + n.id);
|
|
T.assert(readBack._status !== 500, 'XSS note content caused 500');
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] XSS in persona name (stored)', async function () {
|
|
try {
|
|
var p = await T.apiPost('/personas', { name: '"><svg/onload=alert(1)>', scope: 'personal', model: 'test' });
|
|
if (p && p.id) T.registerCleanup(function () { return T.safeDelete('/personas/' + p.id); });
|
|
} catch (e) { /* server rejection is fine */ }
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] oversized channel title (10KB)', async function () {
|
|
var d = await T.authFetch(testUser.token, 'POST', '/channels', { title: 'A'.repeat(10240), type: 'direct' });
|
|
if ((d._status === 200 || d._status === 201) && d.id) {
|
|
T.registerCleanup(function () { return T.safeDelete('/channels/' + d.id); });
|
|
}
|
|
T.assert(d._status !== 500, 'oversized title caused 500');
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] oversized note content (5MB)', async function () {
|
|
try {
|
|
var d = await T.authFetch(testUser.token, 'POST', '/notes', { title: 'big', content: 'X'.repeat(5 * 1024 * 1024) });
|
|
if (d && d.id) T.registerCleanup(function () { return T.safeDelete('/notes/' + d.id); });
|
|
} catch (e) { /* rejection is fine */ }
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] malformed JSON body', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/channels', {
|
|
method: 'POST',
|
|
headers: { 'Authorization': 'Bearer ' + adminToken, 'Content-Type': 'application/json' },
|
|
credentials: 'same-origin',
|
|
body: '{title: invalid, no-quotes}'
|
|
});
|
|
if (resp.status === 502) {
|
|
throw new Error('INCONCLUSIVE (502): proxy returned 502 — may not forward malformed bodies to backend');
|
|
}
|
|
T.assert(resp.status === 400, 'malformed JSON should return 400, got ' + resp.status);
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] Content-Type mismatch (form data as JSON)', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/channels', {
|
|
method: 'POST',
|
|
headers: { 'Authorization': 'Bearer ' + adminToken, 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
credentials: 'same-origin',
|
|
body: 'title=test&type=direct'
|
|
});
|
|
if (resp.status === 502) {
|
|
throw new Error('INCONCLUSIVE (502): proxy returned 502 on content-type mismatch');
|
|
}
|
|
T.assert(resp.status === 400 || resp.status === 415,
|
|
'form data accepted on JSON endpoint, got ' + resp.status);
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P0] path traversal in surface archive', async function () {
|
|
var blob = new Blob([JSON.stringify({ id: '../../../etc/evil', title: 'Path Traversal Test' })], { type: 'application/json' });
|
|
try {
|
|
var d = await T.apiUpload('/admin/surfaces/install', blob, 'evil.surface');
|
|
T.assert(d._status === 400 || d._status === 409,
|
|
'path traversal surface accepted! got ' + d._status);
|
|
} catch (e) {
|
|
if (e.message.indexOf('502') !== -1) {
|
|
throw new Error('INCONCLUSIVE (502): proxy returned 502 on surface upload');
|
|
}
|
|
T.assert(e.message.indexOf('400') !== -1 || e.message.indexOf('409') !== -1 || e.message.indexOf('415') !== -1,
|
|
'unexpected error: ' + e.message);
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P1] null byte in channel ID param', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET', '/channels/abc%00def');
|
|
T.assert(d._status !== 500, 'null byte in ID caused 500');
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P1] extremely long ID param', async function () {
|
|
var d = await T.authFetch(testUser.token, 'GET', '/channels/' + 'a'.repeat(4096));
|
|
T.assert(d._status !== 500, 'extremely long ID caused 500');
|
|
});
|
|
|
|
await T.test('security', 'input-validation', '[P2] unicode RTLO in channel title', async function () {
|
|
var d = await T.authFetch(testUser.token, 'POST', '/channels', { title: 'normal\u202Eelif_gnol', type: 'direct' });
|
|
if ((d._status === 200 || d._status === 201) && d.id) {
|
|
T.registerCleanup(function () { return T.safeDelete('/channels/' + d.id); });
|
|
}
|
|
T.assert(d._status !== 500, 'RTLO character caused 500');
|
|
});
|
|
|
|
// ════════════════════════════════════════════════════════
|
|
// 4. SESSION SECURITY (unauthenticated access)
|
|
// Raw fetch() without auth headers. 502 = INCONCLUSIVE
|
|
// (proxy may not forward unauthenticated requests).
|
|
// ════════════════════════════════════════════════════════
|
|
|
|
await T.test('security', 'session', '[P0] unauthenticated → GET /channels (expect 401)', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/channels', { method: 'GET', credentials: 'same-origin' });
|
|
assertRawDenied(resp, 'unauthenticated access to /channels');
|
|
});
|
|
|
|
await T.test('security', 'session', '[P0] unauthenticated → GET /profile (expect 401)', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/profile', { method: 'GET', credentials: 'same-origin' });
|
|
assertRawDenied(resp, 'unauthenticated access to /profile');
|
|
});
|
|
|
|
await T.test('security', 'session', '[P0] unauthenticated → GET /admin/users (expect 401)', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/admin/users', { method: 'GET', credentials: 'same-origin' });
|
|
assertRawDenied(resp, 'unauthenticated access to admin');
|
|
});
|
|
|
|
await T.test('security', 'session', '[P0] unauthenticated → POST /channels (expect 401)', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/channels', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
credentials: 'same-origin',
|
|
body: JSON.stringify({ title: 'unauth-test', type: 'direct' })
|
|
});
|
|
assertRawDenied(resp, 'unauthenticated channel creation');
|
|
});
|
|
|
|
await T.test('security', 'session', '[P1] cookie-only → attempt JWT-protected endpoints', async function () {
|
|
var d = await T.sessionGet('/notes');
|
|
if (d._status === 502) throw new Error('INCONCLUSIVE (502): proxy returned 502 for cookie-only request');
|
|
T.assert(d._status === 401, 'cookie-only access to /notes returned ' + d._status);
|
|
});
|
|
|
|
await T.test('security', 'session', '[P1] cookie-only → attempt admin endpoints', async function () {
|
|
var d = await T.sessionGet('/admin/stats');
|
|
if (d._status === 502) throw new Error('INCONCLUSIVE (502): proxy returned 502 for cookie-only request');
|
|
T.assert(d._status === 401, 'cookie-only access to /admin/stats returned ' + d._status);
|
|
});
|
|
|
|
// ════════════════════════════════════════════════════════
|
|
// 5. PRIVILEGE ESCALATION ATTEMPTS
|
|
// ════════════════════════════════════════════════════════
|
|
|
|
await T.test('security', 'escalation', '[P0] user → PUT own role to admin', async function () {
|
|
var d = await T.authFetch(testUser.token, 'PUT', '/admin/users/' + testUser.id + '/role', { role: 'admin' });
|
|
assertDenied(d._status, 'CRITICAL: user was able to self-promote to admin');
|
|
});
|
|
|
|
await T.test('security', 'escalation', '[P0] user → POST /admin/users with admin role', async function () {
|
|
var d = await T.authFetch(testUser.token, 'POST', '/admin/users', {
|
|
username: 'should-never-exist-' + Date.now(), password: 'Hack3d!xx',
|
|
email: 'hack@evil.com', role: 'admin'
|
|
});
|
|
assertDenied(d._status, 'CRITICAL: non-admin created an admin user');
|
|
});
|
|
|
|
if (teamAdmin && teamAdmin.token) {
|
|
await T.test('security', 'escalation', '[P0] teamAdmin → PUT /admin/settings', async function () {
|
|
var d = await T.authFetch(teamAdmin.token, 'PUT', '/admin/settings/allow_registration', { value: true });
|
|
assertDenied(d._status, 'team admin can modify platform settings');
|
|
});
|
|
|
|
await T.test('security', 'escalation', '[P0] teamAdmin → DELETE /admin/users/:id', async function () {
|
|
var d = await T.authFetch(teamAdmin.token, 'DELETE', '/admin/users/' + testUser.id);
|
|
assertDenied(d._status, 'CRITICAL: team admin can delete users');
|
|
});
|
|
|
|
await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/surfaces/install', async function () {
|
|
var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/surfaces/install', {});
|
|
if (d._status === 400) return; // bad upload format, not a security issue
|
|
assertDenied(d._status, 'team admin can install surfaces');
|
|
});
|
|
}
|
|
|
|
await T.test('security', 'escalation', '[P0] user_id substitution in channel creation', async function () {
|
|
var d = await T.authFetch(testUser.token, 'POST', '/channels', {
|
|
title: 'impersonation-test-' + Date.now(), type: 'direct', user_id: T.user.id
|
|
});
|
|
if (d._status === 200 || d._status === 201) {
|
|
if (d.id) T.registerCleanup(function () { return T.safeDelete('/channels/' + d.id); });
|
|
T.assert(!d.user_id || d.user_id === testUser.id,
|
|
'CRITICAL: channel created as another user! owner=' + d.user_id);
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'escalation', '[P0] user_id substitution in note creation', async function () {
|
|
var d = await T.authFetch(testUser.token, 'POST', '/notes', {
|
|
title: 'impersonation-' + Date.now(), content: 'test', user_id: T.user.id
|
|
});
|
|
if (d._status === 200 || d._status === 201) {
|
|
if (d.id) T.registerCleanup(function () { return T.safeDelete('/notes/' + d.id); });
|
|
if (d.user_id) {
|
|
T.assert(d.user_id === testUser.id,
|
|
'CRITICAL: note created as another user! owner=' + d.user_id);
|
|
}
|
|
}
|
|
});
|
|
|
|
// ════════════════════════════════════════════════════════
|
|
// 6. HEADER / TRANSPORT SECURITY
|
|
// ════════════════════════════════════════════════════════
|
|
|
|
await T.test('security', 'transport', '[P2] CORS allows wildcard origin', async function () {
|
|
var resp = await fetch(T.base + '/api/v1/health', {
|
|
method: 'OPTIONS',
|
|
headers: { 'Origin': 'https://evil.example.com', 'Access-Control-Request-Method': 'GET' }
|
|
});
|
|
var acao = resp.headers.get('Access-Control-Allow-Origin');
|
|
if (acao === '*') {
|
|
T.assert(false, 'CORS returns Access-Control-Allow-Origin: * — restrict in production');
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'transport', '[P2] auth endpoint rate limiting', async function () {
|
|
var statuses = [];
|
|
for (var i = 0; i < 10; i++) {
|
|
try {
|
|
var d = await T.publicPost('/auth/login', { login: 'nonexistent', password: 'wrong' });
|
|
statuses.push(d._status);
|
|
} catch (e) { statuses.push('err'); }
|
|
}
|
|
var backendStatuses = statuses.filter(function (s) { return s !== 502; });
|
|
if (backendStatuses.length === 0) {
|
|
throw new Error('INCONCLUSIVE (502): all login attempts returned 502 — cannot test rate limiting');
|
|
}
|
|
var rateLimited = backendStatuses.some(function (s) { return s === 429; });
|
|
if (!rateLimited) {
|
|
T.assert(false, 'no rate limiting on /auth/login after ' + backendStatuses.length +
|
|
' attempts reaching backend — statuses: [' + backendStatuses.join(',') + ']');
|
|
}
|
|
});
|
|
|
|
await T.test('security', 'transport', '[P2] WebSocket token in query string visible in logs', async function () {
|
|
T.assert(false,
|
|
'INFO: WebSocket uses ?token= query param (JWT visible in server logs, proxy logs, browser history). ' +
|
|
'Consider using a short-lived ticket exchange instead.');
|
|
});
|
|
};
|
|
|
|
})();
|