@1agh/maude 0.39.0 → 0.40.0

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -67,6 +67,25 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/edit-css',
         '/_api/edit-text',
         '/_api/edit-attr',
+        // DDR-148 — raw canvas source for the Timeline parser is MAIN-ORIGIN
+        // ONLY (the untrusted canvas iframe must never read project source).
+        '/_api/canvas-source',
+        // DDR-148 — Timeline drag-to-retime is a source-write, MAIN-ORIGIN ONLY.
+        '/_api/retime-sequence',
+        // DDR-150 P2 — the clip enumerator reads project source structure, so it
+        // is MAIN-ORIGIN ONLY (same boundary as /_api/canvas-source): the
+        // untrusted canvas iframe must never enumerate the comp it renders.
+        '/_api/comp-clips',
+        // DDR-150 P3 — clip removal is a source-write, MAIN-ORIGIN ONLY.
+        '/_api/remove-sequence',
+        // DDR-150 P4 — clip insert is a source-write, MAIN-ORIGIN ONLY.
+        '/_api/insert-sequence',
+        // DDR-150 P5 — z-order reorder is a source-write, MAIN-ORIGIN ONLY.
+        '/_api/reorder-sequence',
+        // DDR-150 dogfood — array-src replace is a source-write, MAIN-ORIGIN ONLY.
+        '/_api/edit-array-src',
+        // DDR-150 dogfood — clip hide/show is a source-write, MAIN-ORIGIN ONLY.
+        '/_api/toggle-hide',
         // Phase 12.1 (DDR-138) — node-move reorder is a source-write, MAIN-ORIGIN
         // ONLY. The canvas iframe requests a reorder over the dgn:* bus; the shell
         // performs the write. A GET here 403s at the gate (route unreachable on
@@ -141,9 +160,26 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
       const shell = await fetch(`${canvas}/_canvas-shell.html`);
       const csp = shell.headers.get('content-security-policy') ?? '';
       expect(csp).toContain("connect-src 'self'");
+      // DDR-148 — media-src must be present so a video-comp's <Video>/<Audio>
+      // isn't blocked by default-src 'none' (black video / silent audio).
+      expect(csp).toContain("media-src 'self'");
       expect(csp).toContain("webrtc 'block'");
       expect(csp).toContain('frame-ancestors');
       expect(csp).toContain(`http://localhost:${port}`);
+
+      // (5) DDR-148 attacker F1 — the EXPORT/CAPTURE render (?hide-chrome=1) on
+      // the MAIN origin (where the normal shell CSP is off) MUST carry the
+      // network-locked capture CSP, else a canvas <Video src="http://internal">
+      // or comp fetch() turns ⌘E into read-SSRF + exfil-via-artifact.
+      const capMain = await fetch(`http://localhost:${port}/_canvas-shell.html?hide-chrome=1`);
+      const capCsp = capMain.headers.get('content-security-policy') ?? '';
+      expect(capCsp).toContain("media-src 'self'"); // <Video src=external> blocked
+      expect(capCsp).toContain("connect-src 'self'"); // comp fetch(external) blocked
+      expect(capCsp).toContain("img-src 'self'");
+      expect(capCsp).toContain("object-src 'none'");
+      // A normal main-origin shell (no capture flag) stays CSP-off (back-compat).
+      const plainMain = await fetch(`http://localhost:${port}/_canvas-shell.html`);
+      expect(plainMain.headers.get('content-security-policy')).toBeNull();
     } finally {
       await killProc(proc);
     }