@jrpool/kilotest 48.0.0 → 49.0.0

package/web/rewindReportsForm/rewindReportsForm.test.ts

@@ -35,32 +35,40 @@ after(async () => {
 
 // TESTS
 
-test('rewindReportsForm displays a list of reports when no submission', async () => {
-  const result = await answer(null, '');
+test('rewindReportsForm displays a list of reports on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('rewindReportsForm returns an error for an invalid auth code', async () => {
-  const result = await answer(null, 'authCode=wrong&report=260202T0000-new');
+test('rewindReportsForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260202T0000-new.json');
+  const result = await answer(null, 'authCode=test-auth-code&report=260202T0000-new', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been deleted by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('rewindReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(null, 'authCode=wrong&report=260202T0000-new', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('rewindReportsForm returns an error when deleting a nonexistent report', async () => {
-  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('rewindReportsForm returns an error when deleting a nonexistent report on a POST request', async () => {
+  const result = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message?.includes('Deleting latest superseding reports'));
 });
 
-test('rewindReportsForm deletes a latest superseding report with valid auth code', async () => {
+test('rewindReportsForm deletes a latest superseding report with valid auth code on a POST request', async () => {
   // 260202T0000-new is the latest report for its URL, superseding 260101T0000-mix.
   const reportPath = path.join(reportsPath(), '260202T0000-new.json');
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
-    const result = await answer(null, 'authCode=test-auth-code&report=260202T0000-new');
+    const result = await answer(null, 'authCode=test-auth-code&report=260202T0000-new', 'POST');
     assert.equal(result.status, 'ok');
     await fs.access(reportPath).then(
       () => {throw new Error('Report should have been deleted');},
@@ -77,7 +85,7 @@ test('rewindReportsForm returns an error when a report file is corrupt', {timeou
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
     await fs.writeFile(reportPath, 'not valid json');
-    const result = await answer(null, '');
+    const result = await answer(null, '', 'GET');
     assert.equal(result.status, 'error');
   }
   finally {

package/web/showHiddenReportsForm/index.html

@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>View experimental reports | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: View experimental reports</h1>
+      <form action="/showHiddenReportsForm.html" method="post">
+        <p><label>
+          Authorization code: <input size="3" minLength="3" maxlength="3" name="authCode" required>
+        </label></p>
+        <p><button type="submit">Submit</button></p>
+      </form>
+    </main>
+  </body>
+</html>

package/web/showHiddenReportsForm/index.ts

@@ -0,0 +1,45 @@
+/*
+  index.ts
+  Serves a form requesting an authorization code, and, once a valid code is submitted,
+  serves unhideReportForm's own list of hidden reports and its self-submitting unhide
+  form, so that the names of hidden reports are never disclosed without a valid code.
+*/
+
+// IMPORTS
+
+import {populateTemplate} from '../../util.ts';
+import {answer as unhideReportForm} from '../unhideReportForm/index.ts';
+
+// FUNCTIONS
+
+// Returns a form requesting an authorization code on a GET request or an invalid
+// submission, or, on a POST request with a valid code, unhideReportForm's own page
+// (the list of hidden reports and its unhide form). A GET request, regardless of its
+// query string, never processes a submission, so the code cannot be validated by GET.
+export const answer = async (pathTail: any, search: string, method: string) => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  // If the form has been submitted:
+  if (method === 'POST') {
+    // If the authorization code is invalid:
+    if (authCode !== process.env.AUTH_CODE) {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+    // Otherwise, i.e. if the authorization code is valid, serve unhideReportForm's own
+    // page (the list of hidden reports and its self-submitting unhide form).
+    return unhideReportForm(pathTail, search, 'GET');
+  }
+  // Otherwise, i.e. if the form has not been submitted yet, get the populated template.
+  const answerPage = await populateTemplate(import.meta.dirname, {});
+  // Return the populated page.
+  return {
+    status: 'ok',
+    answerPage
+  };
+};

package/web/showHiddenReportsForm/showHiddenReportsForm.test.ts

@@ -0,0 +1,103 @@
+/*
+  showHiddenReportsForm.test.ts
+  Unit tests for web/showHiddenReportsForm/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, after, beforeEach} from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import fs from 'fs/promises';
+import {parse} from 'node-html-parser';
+import {answer} from './index.ts';
+import {reportsPath, hiddenReportsPath} from '../../util.ts';
+
+// CONSTANTS
+
+const hiddenFile = '260101T0007-hid.json';
+
+// SETUP AND TEARDOWN
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedDBDir = process.env.DB_DIR;
+import {fixtureDBDir} from '../../test/dbFixture.ts';
+
+const getPaths = () => ({
+  hidden: path.join(hiddenReportsPath(), hiddenFile),
+  report: path.join(reportsPath(), hiddenFile)
+});
+
+before(() => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.DB_DIR = fixtureDBDir;
+});
+
+beforeEach(async () => {
+  // Ensure the hidden report is in the hidden directory before each test.
+  const {hidden, report} = getPaths();
+  try {
+    await fs.rename(report, hidden);
+  }
+  catch {
+    // Report may already be hidden.
+  }
+});
+
+after(async () => {
+  // Restore the hidden report if it was moved.
+  const {hidden, report} = getPaths();
+  try {
+    await fs.rename(report, hidden);
+  }
+  catch {
+    // Report may already be hidden.
+  }
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedDBDir !== undefined) {
+    process.env.DB_DIR = savedDBDir;
+  }
+});
+
+// TESTS
+
+test('showHiddenReportsForm displays a bare authCode form on a GET request, disclosing nothing', async () => {
+  const result: any = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  assert.ok(html.querySelector('input[name="authCode"]'));
+  assert.equal(html.querySelectorAll('input[type="radio"]').length, 0);
+  assert.ok(!result.answerPage.includes('260101T0007-hid'));
+});
+
+test('showHiddenReportsForm submits its form as a POST', async () => {
+  const result: any = await answer(null, '', 'GET');
+  const html = parse(result.answerPage);
+  const form = html.querySelector('form');
+  assert.equal(form?.getAttribute('method'), 'post');
+});
+
+test('showHiddenReportsForm ignores a valid authCode query string on a GET request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  assert.ok(html.querySelector('input[name="authCode"]'));
+  assert.equal(html.querySelectorAll('input[type="radio"]').length, 0);
+});
+
+test('showHiddenReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong', 'POST');
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+});
+
+test('showHiddenReportsForm serves the hidden reports list on a POST request with a valid auth code', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  const radios = html.querySelectorAll('input[type="radio"]');
+  assert.ok(radios.length > 0);
+  assert.ok(result.answerPage.includes('260101T0007-hid'));
+});

package/web/tutorialAI/index.ts

@@ -75,6 +75,6 @@ export const handleComment = async (content: unknown) => {
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
   // Send an alert to the manager.
-  await sendAlert('New AI tutorial comment received', 'A new AI tutorial comment has been received.');
+  await sendAlert('Kilotest: New AI tutorial comment received', 'A new AI tutorial comment has been received.');
   return {status: 'ok'};
 };

package/web/tutorialWeb/index.ts

@@ -73,6 +73,6 @@ export const handleComment = async (content: unknown) => {
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
   // Send an alert to the manager.
-  await sendAlert('New web tutorial comment received', 'A new web tutorial comment has been received.');
+  await sendAlert('Kilotest: New web tutorial comment received', 'A new web tutorial comment has been received.');
   return {status: 'ok'};
 };

package/web/unhideReportForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Declassify report as experimental</h1>
       <p>Choose a report to declassify as experimental.</p>
-      <form action="/unhideReportForm.html">
+      <form action="/unhideReportForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/unhideReportForm/index.ts

@@ -11,13 +11,14 @@ import path from 'node:path';
 
 // FUNCTIONS
 
-// Returns a form for unhiding a report.
-export const answer = async (_: any, search: string) => {
+// Returns a form for unhiding a report. A GET request never processes a submission,
+// regardless of its query string; only a POST request (the form's own submission) does.
+export const answer = async (_: any, search: string, method: string) => {
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const jobName = searchParams?.get('report');
-  // If the form has been displayed by itself after a submission and a report is to be unhidden:
-  if (jobName) {
+  // If the form has been submitted and a report is to be unhidden:
+  if (method === 'POST' && jobName) {
     // If the authorization code is valid:
     if (authCode === process.env.AUTH_CODE) {
       const fileName = `${jobName}.json`;
@@ -35,10 +36,12 @@ export const answer = async (_: any, search: string) => {
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       }
     }
   }

package/web/unhideReportForm/unhideReportForm.test.ts

@@ -63,8 +63,8 @@ after(async () => {
 
 // TESTS
 
-test('unhideReportForm displays a list of hidden reports when no submission', async () => {
-  const result: any = await answer(null, '');
+test('unhideReportForm displays a list of hidden reports on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
@@ -72,22 +72,30 @@ test('unhideReportForm displays a list of hidden reports when no submission', as
   assert.ok(radios.length > 0);
 });
 
-test('unhideReportForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&report=260101T0007-hid');
+test('unhideReportForm ignores a report query string on a GET request', async () => {
+  const {report} = getPaths();
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0007-hid', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been unhidden by a mere GET request.
+  await assert.rejects(fs.access(report));
+});
+
+test('unhideReportForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&report=260101T0007-hid', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('unhideReportForm unhides a report with valid auth code', async () => {
+test('unhideReportForm unhides a report with valid auth code on a POST request', async () => {
   const {report} = getPaths();
-  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0007-hid');
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0007-hid', 'POST');
   assert.equal(result.status, 'ok');
   // The report should now be in the reports directory.
   await fs.access(report);
 });
 
-test('unhideReportForm returns an error when unhiding a nonexistent report', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('unhideReportForm returns an error when unhiding a nonexistent report on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message.includes('Unhiding report'));
 });
@@ -102,7 +110,7 @@ test('unhideReportForm sorts hidden reports with the same page name by timeStamp
   const copyPath = path.join(hiddenReportsPath(), '260101T0010-hid2.json');
   await fs.writeFile(copyPath, JSON.stringify(copy));
   try {
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     // Both reports should appear in the form.
     assert.ok(result.answerPage.includes('260101T0007-hid'));
@@ -123,7 +131,7 @@ test('unhideReportForm sorts hidden reports with different page names alphabetic
   const copyPath = path.join(hiddenReportsPath(), '260101T0011-hid3.json');
   await fs.writeFile(copyPath, JSON.stringify(copy));
   try {
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     // Both reports should appear in the form.
     assert.ok(result.answerPage.includes('260101T0007-hid'));