@jrpool/kilotest 48.0.0 → 50.0.0

package/web/showHiddenReportsForm/showHiddenReportsForm.test.ts

@@ -0,0 +1,103 @@
+/*
+  showHiddenReportsForm.test.ts
+  Unit tests for web/showHiddenReportsForm/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, after, beforeEach} from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import fs from 'fs/promises';
+import {parse} from 'node-html-parser';
+import {answer} from './index.ts';
+import {reportsPath, hiddenReportsPath} from '../../util.ts';
+
+// CONSTANTS
+
+const hiddenFile = '260101T0007-hid.json';
+
+// SETUP AND TEARDOWN
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedDBDir = process.env.DB_DIR;
+import {fixtureDBDir} from '../../test/dbFixture.ts';
+
+const getPaths = () => ({
+  hidden: path.join(hiddenReportsPath(), hiddenFile),
+  report: path.join(reportsPath(), hiddenFile)
+});
+
+before(() => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.DB_DIR = fixtureDBDir;
+});
+
+beforeEach(async () => {
+  // Ensure the hidden report is in the hidden directory before each test.
+  const {hidden, report} = getPaths();
+  try {
+    await fs.rename(report, hidden);
+  }
+  catch {
+    // Report may already be hidden.
+  }
+});
+
+after(async () => {
+  // Restore the hidden report if it was moved.
+  const {hidden, report} = getPaths();
+  try {
+    await fs.rename(report, hidden);
+  }
+  catch {
+    // Report may already be hidden.
+  }
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedDBDir !== undefined) {
+    process.env.DB_DIR = savedDBDir;
+  }
+});
+
+// TESTS
+
+test('showHiddenReportsForm displays a bare authCode form on a GET request, disclosing nothing', async () => {
+  const result: any = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  assert.ok(html.querySelector('input[name="authCode"]'));
+  assert.equal(html.querySelectorAll('input[type="radio"]').length, 0);
+  assert.ok(!result.answerPage.includes('260101T0007-hid'));
+});
+
+test('showHiddenReportsForm submits its form as a POST', async () => {
+  const result: any = await answer(null, '', 'GET');
+  const html = parse(result.answerPage);
+  const form = html.querySelector('form');
+  assert.equal(form?.getAttribute('method'), 'post');
+});
+
+test('showHiddenReportsForm ignores a valid authCode query string on a GET request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code', 'GET');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  assert.ok(html.querySelector('input[name="authCode"]'));
+  assert.equal(html.querySelectorAll('input[type="radio"]').length, 0);
+});
+
+test('showHiddenReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong', 'POST');
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+});
+
+test('showHiddenReportsForm serves the hidden reports list on a POST request with a valid auth code', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code', 'POST');
+  assert.equal(result.status, 'ok');
+  const html = parse(result.answerPage);
+  const radios = html.querySelectorAll('input[type="radio"]');
+  assert.ok(radios.length > 0);
+  assert.ok(result.answerPage.includes('260101T0007-hid'));
+});

package/web/tutorialAI/index.ts

@@ -75,6 +75,6 @@ export const handleComment = async (content: unknown) => {
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
   // Send an alert to the manager.
-  await sendAlert('New AI tutorial comment received', 'A new AI tutorial comment has been received.');
+  await sendAlert('Kilotest: New AI tutorial comment received', 'A new AI tutorial comment has been received.');
   return {status: 'ok'};
 };

package/web/tutorialWeb/index.ts

@@ -73,6 +73,6 @@ export const handleComment = async (content: unknown) => {
   // Save the revised comments.
   await fs.writeFile(commentsPath, getJSON(comments));
   // Send an alert to the manager.
-  await sendAlert('New web tutorial comment received', 'A new web tutorial comment has been received.');
+  await sendAlert('Kilotest: New web tutorial comment received', 'A new web tutorial comment has been received.');
   return {status: 'ok'};
 };

package/web/unhideReportForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Declassify report as experimental</h1>
       <p>Choose a report to declassify as experimental.</p>
-      <form action="/unhideReportForm.html">
+      <form action="/unhideReportForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/unhideReportForm/index.ts

@@ -5,21 +5,24 @@
 
 // IMPORTS
 
-import {hiddenReportsPath, populateTemplate, readdirOrCreate, reportsPath} from '../../util.ts';
+import {
+  hiddenReportsPath, isValidAuthCode, populateTemplate, readdirOrCreate, reportsPath
+} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
 // FUNCTIONS
 
-// Returns a form for unhiding a report.
-export const answer = async (_: any, search: string) => {
+// Returns a form for unhiding a report. A GET request never processes a submission,
+// regardless of its query string; only a POST request (the form's own submission) does.
+export const answer = async (_: any, search: string, method: string) => {
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const jobName = searchParams?.get('report');
-  // If the form has been displayed by itself after a submission and a report is to be unhidden:
-  if (jobName) {
+  // If the form has been submitted and a report is to be unhidden:
+  if (method === 'POST' && jobName) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const fileName = `${jobName}.json`;
       try {
         // Move the report to the reports directory.
@@ -35,10 +38,12 @@ export const answer = async (_: any, search: string) => {
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       }
     }
   }

package/web/unhideReportForm/unhideReportForm.test.ts

@@ -63,8 +63,8 @@ after(async () => {
 
 // TESTS
 
-test('unhideReportForm displays a list of hidden reports when no submission', async () => {
-  const result: any = await answer(null, '');
+test('unhideReportForm displays a list of hidden reports on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
@@ -72,22 +72,30 @@ test('unhideReportForm displays a list of hidden reports when no submission', as
   assert.ok(radios.length > 0);
 });
 
-test('unhideReportForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&report=260101T0007-hid');
+test('unhideReportForm ignores a report query string on a GET request', async () => {
+  const {report} = getPaths();
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0007-hid', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been unhidden by a mere GET request.
+  await assert.rejects(fs.access(report));
+});
+
+test('unhideReportForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&report=260101T0007-hid', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('unhideReportForm unhides a report with valid auth code', async () => {
+test('unhideReportForm unhides a report with valid auth code on a POST request', async () => {
   const {report} = getPaths();
-  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0007-hid');
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0007-hid', 'POST');
   assert.equal(result.status, 'ok');
   // The report should now be in the reports directory.
   await fs.access(report);
 });
 
-test('unhideReportForm returns an error when unhiding a nonexistent report', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('unhideReportForm returns an error when unhiding a nonexistent report on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message.includes('Unhiding report'));
 });
@@ -102,7 +110,7 @@ test('unhideReportForm sorts hidden reports with the same page name by timeStamp
   const copyPath = path.join(hiddenReportsPath(), '260101T0010-hid2.json');
   await fs.writeFile(copyPath, JSON.stringify(copy));
   try {
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     // Both reports should appear in the form.
     assert.ok(result.answerPage.includes('260101T0007-hid'));
@@ -123,7 +131,7 @@ test('unhideReportForm sorts hidden reports with different page names alphabetic
   const copyPath = path.join(hiddenReportsPath(), '260101T0011-hid3.json');
   await fs.writeFile(copyPath, JSON.stringify(copy));
   try {
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     // Both reports should appear in the form.
     assert.ok(result.answerPage.includes('260101T0007-hid'));