mirror of
https://github.com/certctl-io/certctl.git
synced 2026-08-29 18:31:24 +02:00
a5c4f42ec9
Closes M-029 Pass 3 fully. Every src/pages/*.tsx now has a *.test.tsx peer.
Audit recon: 'comm -23 <pages> <test-peers>' returns zero (all 14 T-1-deferred
pages now covered).
Test files added (each ships render-coverage + an XSS-hardening contract):
- HealthMonitorPage.test.tsx endpoint URL + last_error payloads
- JobsPage.test.tsx type / certificate_id / agent_id /
error_message payloads
- NetworkScanPage.test.tsx network_range / agent_id / last_scan_message
payloads
- ProfilesPage.test.tsx profile name / description / EKUs payloads
- AgentFleetPage.test.tsx agent name / hostname / OS / arch / IP
payloads (mirrors the M-003 MCP fence shape)
Pass 3 totals across batches A + B + C: 14 new test files, 14/14 T-1-deferred
pages closed. Each test pins three invariants:
1. The page renders against mock data without crashing.
2. No live <script data-xss='...'> attaches to the DOM.
3. The literal payload appears as escaped text content (proving the page
surfaces the data without rendering it as HTML).
M-029 status after Pass 3:
Pass 1 — useMutation -> useTrackedMutation COMPLETE (6 batches, 56 -> 0)
Pass 2 — useState pagination -> useListParams COMPLETE (CertificatesPage)
Pass 3 — XSS-hardening test suites COMPLETE (14/14 pages)
M-029 IS NOW READY TO CLOSE.
82 lines
2.7 KiB
TypeScript
82 lines
2.7 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest';
|
|
import { render, screen, waitFor, cleanup } from '@testing-library/react';
|
|
import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
|
|
import { MemoryRouter } from 'react-router-dom';
|
|
import type { ReactNode } from 'react';
|
|
|
|
// -----------------------------------------------------------------------------
|
|
// M-029 Pass 3 (Audit M-026): ProfilesPage XSS-hardening + render coverage.
|
|
// Profile name + description are operator-supplied free text.
|
|
// -----------------------------------------------------------------------------
|
|
|
|
vi.mock('../api/client', () => ({
|
|
getProfiles: vi.fn(),
|
|
deleteProfile: vi.fn(),
|
|
createProfile: vi.fn(),
|
|
updateProfile: vi.fn(),
|
|
}));
|
|
|
|
import ProfilesPage from './ProfilesPage';
|
|
import * as client from '../api/client';
|
|
|
|
function renderWithQuery(ui: ReactNode) {
|
|
const qc = new QueryClient({
|
|
defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
|
|
});
|
|
return render(
|
|
<QueryClientProvider client={qc}>
|
|
<MemoryRouter>{ui}</MemoryRouter>
|
|
</QueryClientProvider>,
|
|
);
|
|
}
|
|
|
|
const xssPayload = '<script data-xss="profiles">window.__xss_pwned__=1;</script>';
|
|
|
|
const xssProfile = {
|
|
id: 'cp-xss-001',
|
|
name: xssPayload,
|
|
description: xssPayload,
|
|
max_ttl_seconds: 3600,
|
|
allow_short_lived: false,
|
|
ekus: [xssPayload],
|
|
key_usages: [xssPayload],
|
|
san_types: [xssPayload],
|
|
created_at: new Date().toISOString(),
|
|
};
|
|
|
|
describe('ProfilesPage — render + XSS hardening (M-026 / M-029 Pass 3)', () => {
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
cleanup();
|
|
delete (window as unknown as { __xss_pwned__?: number }).__xss_pwned__;
|
|
});
|
|
|
|
it('renders the page header when getProfiles resolves', async () => {
|
|
vi.mocked(client.getProfiles).mockResolvedValue({ data: [], total: 0, page: 1, per_page: 50 } as never);
|
|
renderWithQuery(<ProfilesPage />);
|
|
await waitFor(() => {
|
|
expect(screen.getByText(/Profile/i)).toBeInTheDocument();
|
|
});
|
|
});
|
|
|
|
it('does NOT execute <script> payloads in profile name / description / EKUs', async () => {
|
|
vi.mocked(client.getProfiles).mockResolvedValue({
|
|
data: [xssProfile],
|
|
total: 1,
|
|
page: 1,
|
|
per_page: 50,
|
|
} as never);
|
|
renderWithQuery(<ProfilesPage />);
|
|
await waitFor(() => {
|
|
expect(document.body.textContent ?? '').toContain('<script data-xss="profiles">');
|
|
});
|
|
|
|
const liveScripts = document.querySelectorAll('script[data-xss="profiles"]');
|
|
expect(liveScripts.length, 'profile fields must not inject a live <script>').toBe(0);
|
|
expect(
|
|
(window as unknown as { __xss_pwned__?: number }).__xss_pwned__,
|
|
'profile <script> body must not have executed',
|
|
).toBeUndefined();
|
|
});
|
|
});
|