john
7f8d692d16
Fix DEV logout cookie clearing, materialize selected MindSpace OA assets before agent runs, and recover zombie runs from synced workspace pages. Add client run wait timeout, harness retry limits, page-edit asset forwarding, and logout/john2 scenario tests. Co-authored-by: Cursor <cursoragent@cursor.com>
71 lines
2.5 KiB
JavaScript
71 lines
2.5 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { runBasicFileScan } from './mindspace-scan.mjs';
|
|
|
|
test('runBasicFileScan passes plain text files', () => {
|
|
const result = runBasicFileScan(Buffer.from('hello world'), {
|
|
filename: 'note.txt',
|
|
mimeType: 'text/plain',
|
|
});
|
|
assert.equal(result.scanStatus, 'passed');
|
|
});
|
|
|
|
test('runBasicFileScan blocks inline script payloads', () => {
|
|
const result = runBasicFileScan(Buffer.from('<script>alert(1)</script>'), {
|
|
filename: 'note.md',
|
|
mimeType: 'text/markdown',
|
|
});
|
|
assert.equal(result.scanStatus, 'blocked');
|
|
assert.equal(result.riskLevel, 'high');
|
|
});
|
|
|
|
test('runBasicFileScan warns for sandboxed html with inline script and trusted Chart.js', () => {
|
|
const result = runBasicFileScan(
|
|
Buffer.from(`<!doctype html>
|
|
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
|
|
<script>new Chart(document.createElement('canvas'), { type: 'bar', data: { labels: [] } });</script>`),
|
|
{
|
|
filename: 'dashboard.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
},
|
|
);
|
|
assert.equal(result.scanStatus, 'warned');
|
|
assert.equal(result.riskLevel, 'medium');
|
|
assert.deepEqual(result.findings, ['trusted_html_active_content']);
|
|
});
|
|
|
|
test('runBasicFileScan still blocks unsafe html active content in sandbox mode', () => {
|
|
const javascriptUrl = runBasicFileScan(Buffer.from('<a href="javascript:alert(1)">go</a>'), {
|
|
filename: 'dashboard.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
});
|
|
assert.equal(javascriptUrl.scanStatus, 'blocked');
|
|
assert.deepEqual(javascriptUrl.findings, ['javascript_url']);
|
|
|
|
const unknownScript = runBasicFileScan(
|
|
Buffer.from('<script src="https://evil.example/app.js"></script>'),
|
|
{
|
|
filename: 'dashboard.html',
|
|
mimeType: 'text/html',
|
|
htmlActiveContentPolicy: 'sandbox_warn',
|
|
},
|
|
);
|
|
assert.equal(unknownScript.scanStatus, 'blocked');
|
|
assert.deepEqual(unknownScript.findings, ['text_active_content']);
|
|
});
|
|
|
|
test('runBasicFileScan blocks suspicious zip compression ratio', () => {
|
|
const buffer = Buffer.alloc(64);
|
|
buffer.write('PK', 0);
|
|
buffer.writeUInt16LE(8, 8);
|
|
buffer.writeUInt32LE(10, 18);
|
|
buffer.writeUInt32LE(5000, 22);
|
|
const result = runBasicFileScan(buffer, {
|
|
filename: 'report.docx',
|
|
mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
|
|
});
|
|
assert.equal(result.scanStatus, 'blocked');
|
|
});
|