john
53c5f6d9c2
Memind CI / Test, build, and release guards (pull_request) Failing after 19s
Strip image_url from persisted session payloads, keep image turns scoped to the active request, and align proxy/vision/page-data paths so WeChat image history does not leak into fresh sessions. Co-authored-by: Cursor <cursoragent@cursor.com>
86 lines
3.0 KiB
JavaScript
86 lines
3.0 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { runBasicFileScan } from './mindspace-scan.mjs';
|
|
|
|
test('runBasicFileScan passes plain text files', () => {
|
|
const result = runBasicFileScan(Buffer.from('hello world'), {
|
|
filename: 'note.txt',
|
|
mimeType: 'text/plain',
|
|
});
|
|
assert.equal(result.scanStatus, 'passed');
|
|
});
|
|
|
|
test('runBasicFileScan blocks inline script payloads', () => {
|
|
const result = runBasicFileScan(Buffer.from('<script>alert(1)</script>'), {
|
|
filename: 'note.md',
|
|
mimeType: 'text/markdown',
|
|
});
|
|
assert.equal(result.scanStatus, 'blocked');
|
|
assert.equal(result.riskLevel, 'high');
|
|
});
|
|
|
|
test('runBasicFileScan warns for sandboxed html with inline script and trusted Chart.js', () => {
|
|
const result = runBasicFileScan(
|
|
Buffer.from(`<!doctype html>
|
|
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
|
|
<script>new Chart(document.createElement('canvas'), { type: 'bar', data: { labels: [] } });</script>`),
|
|
{
|
|
filename: 'dashboard.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
},
|
|
);
|
|
assert.equal(result.scanStatus, 'warned');
|
|
assert.equal(result.riskLevel, 'medium');
|
|
assert.deepEqual(result.findings, ['trusted_html_active_content']);
|
|
});
|
|
|
|
test('runBasicFileScan warns for sandboxed html with page-data-client and inline script', () => {
|
|
const result = runBasicFileScan(
|
|
Buffer.from(`<!doctype html>
|
|
<script src="/assets/page-data-client.js"></script>
|
|
<script>MindSpacePageData.createClient({ apiBase: "/api" });</script>`),
|
|
{
|
|
filename: 'survey.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
},
|
|
);
|
|
assert.equal(result.scanStatus, 'warned');
|
|
assert.deepEqual(result.findings, ['trusted_html_active_content']);
|
|
});
|
|
|
|
test('runBasicFileScan still blocks unsafe html active content in sandbox mode', () => {
|
|
const javascriptUrl = runBasicFileScan(Buffer.from('<a href="javascript:alert(1)">go</a>'), {
|
|
filename: 'dashboard.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
});
|
|
assert.equal(javascriptUrl.scanStatus, 'blocked');
|
|
assert.deepEqual(javascriptUrl.findings, ['javascript_url']);
|
|
|
|
const unknownScript = runBasicFileScan(
|
|
Buffer.from('<script src="https://evil.example/app.js"></script>'),
|
|
{
|
|
filename: 'dashboard.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
},
|
|
);
|
|
assert.equal(unknownScript.scanStatus, 'blocked');
|
|
assert.deepEqual(unknownScript.findings, ['text_active_content']);
|
|
});
|
|
|
|
test('runBasicFileScan blocks suspicious zip compression ratio', () => {
|
|
const buffer = Buffer.alloc(64);
|
|
buffer.write('PK', 0);
|
|
buffer.writeUInt16LE(8, 8);
|
|
buffer.writeUInt32LE(10, 18);
|
|
buffer.writeUInt32LE(5000, 22);
|
|
const result = runBasicFileScan(buffer, {
|
|
filename: 'report.docx',
|
|
mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
|
|
});
|
|
assert.equal(result.scanStatus, 'blocked');
|
|
});
|