@tellescope/sdk 1.255.18 → 1.256.0

package/lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js

@@ -0,0 +1,242 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitize_user_html_with_iframes_tests = void 0;
+var utilities_1 = require("@tellescope/utilities");
+// Companion to F-0013-sanitize-user-html.test.ts (pattern 06 — XSS via dangerouslySetInnerHTML).
+//
+// sanitize_user_html_with_iframes is the variant used by the live form's field description, so
+// admins can embed video / scheduling widgets. It permits <iframe> and NOTHING else beyond what
+// sanitize_user_html allows. This asserts:
+//   1. permitting iframe did not reopen any of the F-0013 vectors (the full payload list is re-run)
+//   2. only absolute https iframes survive — relative, protocol-relative, http, javascript:, data:
+//      and srcdoc frames are dropped, along with their fallback content
+//   3. the restrictive sandbox is forced, but an author-supplied sandbox is honored
+//   4. sanitize_user_html itself still strips iframes (the boundary between the two functions)
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   ./build_cjs.sh && cd packages/public/sdk && node -r dotenv/config lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js
+var fail = function (msg) { throw new Error(msg); };
+// Same as has_no_executable_vector in the F-0013 test, minus the '<iframe' clause (iframes are
+// expected in this function's output). Everything else must still be neutralized.
+var has_no_executable_vector_allowing_iframe = function (out) {
+    var o = out.toLowerCase();
+    var withoutValues = o.replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''");
+    return !/\son[a-z]+\s*=/.test(withoutValues) // no live on*= event-handler attribute
+        && !o.includes('javascript:')
+        && !o.includes('vbscript:')
+        && !o.includes('<script')
+        && !o.includes('<svg')
+        && !o.includes('<math')
+        && !o.includes('<object')
+        && !o.includes('<embed')
+        && !o.includes('<form')
+        && !o.includes('<noscript')
+        && !o.includes('<template')
+        && !o.includes('srcdoc'); // an inline document is arbitrary markup
+};
+// Tokens that must NEVER appear in the forced default. allow-top-navigation is the important one:
+// it is what stops a hostile embed from redirecting the patient's form page to a phishing site.
+var FORBIDDEN_SANDBOX_TOKENS = [
+    'allow-top-navigation',
+    'allow-downloads',
+    'allow-modals',
+    'allow-pointer-lock',
+    'allow-orientation-lock',
+];
+var sanitize_user_html_with_iframes_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var xssPayloads, _i, xssPayloads_1, _a, name_1, payload, out, badSrcs, _b, badSrcs_1, _c, name_2, src, out, fallback, srcdoc, handlers, yt, _d, FORBIDDEN_SANDBOX_TOKENS_1, token, authorSandbox, emptySandbox, noref, allowAttr, heading, table, list, link, img, dataimg, fmt, shared, adminTemplate, templated, endToEnd;
+    return __generator(this, function (_e) {
+        console.log("Running sanitize_user_html_with_iframes XSS regression tests");
+        xssPayloads = [
+            ['img onerror', "<img src=x onerror=\"alert(document.domain)\">"],
+            ['svg onload', "<svg onload=\"alert(1)\"></svg>"],
+            ['svg animate onbegin', "<svg><animate onbegin=\"alert(1)\" attributeName=\"x\" dur=\"1s\"></svg>"],
+            ['details ontoggle', "<details open ontoggle=\"alert(1)\"></details>"],
+            ['input onfocus autofocus', "<input autofocus onfocus=\"alert(1)\">"],
+            ['body onpageshow', "<body onpageshow=\"alert(1)\">"],
+            ['a javascript scheme', "<a href=\"javascript:alert(1)\">x</a>"],
+            ['a javascript entity-encoded', "<a href=\"jav&#x09;ascript:alert(1)\">x</a>"],
+            ['script tag', "<script>alert(1)</script>"],
+            ['onerror newline before =', "<img src=x onerror\n=\"alert(1)\">"],
+            ['onerror mixed case', "<IMG SRC=x OnErRoR=\"alert(1)\">"],
+            ['marquee onstart', "<marquee onstart=\"alert(1)\">x</marquee>"],
+            ['mathml mglyph style mxss', "<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>"],
+            ['svg foreignObject', "<svg><foreignObject><img src=x onerror=alert(1)></foreignObject></svg>"],
+            ['noscript context confusion', "<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">"],
+            ['template content', "<template><img src=x onerror=alert(1)></template>"],
+            ['comment confusion', "<!--><img src=x onerror=alert(1)>-->"],
+            ['cdata confusion', "<![CDATA[<img src=x onerror=alert(1)>]]>"],
+            ['markup inside attr value', "<img src=\"x\" alt=\"<script>alert(1)</script>\">"],
+            ['vbscript scheme', "<a href=\"vbscript:msgbox(1)\">x</a>"],
+            ['data text/html href', "<a href=\"data:text/html,<script>alert(1)</script>\">x</a>"],
+            ['javascript decimal entity', "<a href=\"&#74;avascript:alert(1)\">x</a>"],
+            ['javascript newline entity', "<a href=\"jav&#x0A;ascript:alert(1)\">x</a>"],
+        ];
+        for (_i = 0, xssPayloads_1 = xssPayloads; _i < xssPayloads_1.length; _i++) {
+            _a = xssPayloads_1[_i], name_1 = _a[0], payload = _a[1];
+            out = (0, utilities_1.sanitize_user_html_with_iframes)(payload);
+            if (!has_no_executable_vector_allowing_iframe(out))
+                fail("XSS not neutralized [".concat(name_1, "] -> ").concat(out));
+        }
+        badSrcs = [
+            ['javascript scheme', "javascript:alert(1)"],
+            ['data text/html', "data:text/html,<script>alert(1)</script>"],
+            ['http (not https)', "http://evil.example"],
+            // sanitize-html does NOT reject protocol-relative iframe srcs on its own when
+            // allowProtocolRelative is set — this is the self-origin framing vector and the reason the
+            // sanitizer does its own absolute-https check.
+            ['protocol-relative', "//app.tellescope.com/"],
+            ['root-relative', "/portal/settings"],
+            ['bare relative', "settings"],
+            ['whitespace-obfuscated', "  https:/\\/\\evil"],
+            ['tab-entity javascript', "jav&#x09;ascript:alert(1)"],
+            ['scheme-only', "https://"],
+            ['empty', ""],
+        ];
+        for (_b = 0, badSrcs_1 = badSrcs; _b < badSrcs_1.length; _b++) {
+            _c = badSrcs_1[_b], name_2 = _c[0], src = _c[1];
+            out = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"".concat(src, "\"></iframe>"));
+            if (out.toLowerCase().includes('<iframe'))
+                fail("bad iframe src survived [".concat(name_2, "] -> ").concat(out));
+        }
+        fallback = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"/x\">FALLBACK-TEXT</iframe>");
+        if (fallback.includes('FALLBACK-TEXT'))
+            fail("dropped iframe leaked its fallback text: ".concat(fallback));
+        if (fallback.toLowerCase().includes('<iframe'))
+            fail("dropped iframe survived: ".concat(fallback));
+        srcdoc = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" srcdoc=\"<img src=x onerror=alert(1)>\"></iframe>");
+        if (srcdoc.toLowerCase().includes('srcdoc'))
+            fail("srcdoc not stripped: ".concat(srcdoc));
+        if (!srcdoc.toLowerCase().includes('<iframe'))
+            fail("valid iframe dropped alongside srcdoc: ".concat(srcdoc));
+        handlers = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" onload=\"alert(1)\" id=\"x\" name=\"getElementById\"></iframe>");
+        if (!handlers.toLowerCase().includes('<iframe'))
+            fail("valid iframe dropped: ".concat(handlers));
+        if (/\son[a-z]+\s*=/.test(handlers.toLowerCase()))
+            fail("iframe event handler survived: ".concat(handlers));
+        if (/\b(id|name)\s*=/.test(handlers))
+            fail("iframe id/name not stripped (DOM clobbering): ".concat(handlers));
+        yt = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe width=\"560\" height=\"315\" src=\"https://www.youtube.com/embed/abc\" frameBorder=\"0\"></iframe>");
+        if (!yt.includes('src="https://www.youtube.com/embed/abc"'))
+            fail("youtube embed src stripped: ".concat(yt));
+        if (!(yt.includes('width="560"') && yt.includes('height="315"')))
+            fail("iframe dimensions stripped: ".concat(yt));
+        if (!yt.toLowerCase().includes('frameborder'))
+            fail("frameborder stripped: ".concat(yt));
+        // forced containment
+        if (!yt.includes("sandbox=\"".concat(utilities_1.DEFAULT_IFRAME_SANDBOX, "\"")))
+            fail("sandbox not forced: ".concat(yt));
+        if (!yt.toLowerCase().includes('referrerpolicy='))
+            fail("referrerpolicy not set: ".concat(yt));
+        for (_d = 0, FORBIDDEN_SANDBOX_TOKENS_1 = FORBIDDEN_SANDBOX_TOKENS; _d < FORBIDDEN_SANDBOX_TOKENS_1.length; _d++) {
+            token = FORBIDDEN_SANDBOX_TOKENS_1[_d];
+            if (utilities_1.DEFAULT_IFRAME_SANDBOX.includes(token))
+                fail("forced sandbox must not grant ".concat(token, ": ").concat(utilities_1.DEFAULT_IFRAME_SANDBOX));
+        }
+        // allow-same-origin IS granted — required for real embeds (a Loom embed renders blank without it)
+        // and harmless because the src is guaranteed cross-origin by the check asserted above.
+        if (!utilities_1.DEFAULT_IFRAME_SANDBOX.includes('allow-same-origin'))
+            fail("forced sandbox must grant allow-same-origin so real embeds render: ".concat(utilities_1.DEFAULT_IFRAME_SANDBOX));
+        authorSandbox = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" sandbox=\"allow-scripts\"></iframe>");
+        if (!authorSandbox.includes('sandbox="allow-scripts"'))
+            fail("author sandbox not honored: ".concat(authorSandbox));
+        emptySandbox = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" sandbox=\"\"></iframe>");
+        if (emptySandbox.includes('allow-'))
+            fail("empty sandbox was replaced with the permissive default: ".concat(emptySandbox));
+        if (!/\ssandbox(\s|>)/.test(emptySandbox))
+            fail("empty sandbox attribute lost entirely: ".concat(emptySandbox));
+        noref = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" referrerpolicy=\"no-referrer\"></iframe>");
+        if (!noref.includes('referrerpolicy="no-referrer"'))
+            fail("author referrerpolicy not honored: ".concat(noref));
+        allowAttr = (0, utilities_1.sanitize_user_html_with_iframes)("<iframe src=\"https://ok.example\" allow=\"autoplay; encrypted-media\" allowfullscreen></iframe>");
+        if (!allowAttr.includes('allow="autoplay; encrypted-media"'))
+            fail("allow attribute stripped: ".concat(allowAttr));
+        heading = (0, utilities_1.sanitize_user_html_with_iframes)("<h1>Welcome</h1><h3 style=\"color:#333\">Sub</h3>");
+        if (!(heading.includes('<h1>') && heading.includes('<h3') && heading.toLowerCase().includes('color')))
+            fail("headings/style stripped: ".concat(heading));
+        table = (0, utilities_1.sanitize_user_html_with_iframes)("<table><thead><tr><th>H</th></tr></thead><tbody><tr><td style=\"padding:4px\" colspan=\"2\">cell</td></tr></tbody></table>");
+        if (!(table.includes('<table') && table.includes('<td') && table.includes('colspan')))
+            fail("table stripped: ".concat(table));
+        list = (0, utilities_1.sanitize_user_html_with_iframes)("<ul><li>a</li></ul><ol start=\"3\"><li>c</li></ol>");
+        if (!(list.includes('<ul') && list.includes('<li') && list.includes('<ol')))
+            fail("list stripped: ".concat(list));
+        link = (0, utilities_1.sanitize_user_html_with_iframes)("<a href=\"https://example.com\">link</a>");
+        if (!link.includes('href="https://example.com"'))
+            fail("safe link stripped: ".concat(link));
+        if (!link.toLowerCase().includes('noopener'))
+            fail("external link not hardened: ".concat(link));
+        img = (0, utilities_1.sanitize_user_html_with_iframes)("<img src=\"https://cdn.example.com/a.png\" alt=\"pic\" width=\"200\">");
+        if (!(img.includes('src="https://cdn.example.com/a.png"') && img.includes('alt="pic"')))
+            fail("image stripped: ".concat(img));
+        dataimg = (0, utilities_1.sanitize_user_html_with_iframes)("<img src=\"data:image/png;base64,iVBORw0KGgo=\">");
+        if (!dataimg.includes('data:image/png'))
+            fail("data: image stripped: ".concat(dataimg));
+        fmt = (0, utilities_1.sanitize_user_html_with_iframes)("<p><strong>b</strong> <em>i</em> <span style=\"font-size:14px\">s</span></p><blockquote>q</blockquote>");
+        if (!(fmt.includes('<strong>') && fmt.includes('<span') && fmt.toLowerCase().includes('font-size')))
+            fail("formatting stripped: ".concat(fmt));
+        shared = (0, utilities_1.sanitize_user_html)("<iframe src=\"https://www.youtube.com/embed/abc\"></iframe>");
+        if (shared.toLowerCase().includes('<iframe'))
+            fail("sanitize_user_html must still strip iframes: ".concat(shared));
+        adminTemplate = "<p>Hi {{enduser.fname}}, watch this:</p><iframe src=\"https://www.youtube.com/embed/abc\"></iframe>";
+        templated = (0, utilities_1.replace_form_field_template_values)(adminTemplate, {
+            enduser: { fname: "<iframe src=\"https://evil.example/phish\"></iframe>" },
+            responses: [],
+            escapeNewlinesAsHTMLBreaks: true,
+            escapeHTMLValues: true,
+        });
+        endToEnd = (0, utilities_1.sanitize_user_html_with_iframes)(templated);
+        if (!endToEnd.includes('src="https://www.youtube.com/embed/abc"'))
+            fail("admin's own iframe did not survive: ".concat(endToEnd));
+        // The patient's markup must survive only as inert escaped text — so 'evil.example' may still
+        // appear as visible characters, but there must be exactly one LIVE frame (the admin's).
+        if (!endToEnd.includes('&lt;iframe'))
+            fail("patient markup not escaped to inert text: ".concat(endToEnd));
+        if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1)
+            fail("patient-injected iframe became a live frame: ".concat(endToEnd));
+        console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed");
+        return [2 /*return*/];
+    });
+}); };
+exports.sanitize_user_html_with_iframes_tests = sanitize_user_html_with_iframes_tests;
+if (require.main === module) {
+    (0, exports.sanitize_user_html_with_iframes_tests)()
+        .then(function () { console.log("✅ suite completed"); process.exit(0); })
+        .catch(function (err) { console.error("❌ suite failed:", err); process.exit(1); });
+}
+//# sourceMappingURL=F-0013-sanitize-user-html-with-iframes.test.js.map

package/lib/cjs/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0013-sanitize-user-html-with-iframes.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0013-sanitize-user-html-with-iframes.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mDAAuJ;AAEvJ,iGAAiG;AACjG,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,2CAA2C;AAC3C,oGAAoG;AACpG,mGAAmG;AACnG,wEAAwE;AACxE,oFAAoF;AACpF,+FAA+F;AAC/F,EAAE;AACF,yFAAyF;AACzF,sJAAsJ;AAEtJ,IAAM,IAAI,GAAG,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,CAAC,CAAA;AAEtD,+FAA+F;AAC/F,kFAAkF;AAClF,IAAM,wCAAwC,GAAG,UAAC,GAAW;IAC3D,IAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC3B,IAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC3E,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAG,uCAAuC;WAC/E,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;WAC1B,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;WACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;WACrB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;WACpB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;WACxB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA,CAAmB,yCAAyC;AAC1F,CAAC,CAAA;AAED,kGAAkG;AAClG,gGAAgG;AAChG,IAAM,wBAAwB,GAAG;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,cAAc;IACd,oBAAoB;IACpB,wBAAwB;CACzB,CAAA;AAEM,IAAM,qCAAqC,GAAG;;;QACnD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QAKrE,WAAW,GAAuB;YACtC,CAAC,aAAa,EAAE,gDAA8C,CAAC;YAC/D,CAAC,YAAY,EAAE,iCAA+B,CAAC;YAC/C,CAAC,qBAAqB,EAAE,0EAAoE,CAAC;YAC7F,CAAC,kBAAkB,EAAE,gDAA8C,CAAC;YACpE,CAAC,yBAAyB,EAAE,wCAAsC,CAAC;YACnE,CAAC,iBAAiB,EAAE,gCAA8B,CAAC;YACnD,CAAC,qBAAqB,EAAE,uCAAqC,CAAC;YAC9D,CAAC,6BAA6B,EAAE,6CAA2C,CAAC;YAC5E,CAAC,YAAY,EAAE,2BAA2B,CAAC;YAC3C,CAAC,0BAA0B,EAAE,oCAAkC,CAAC;YAChE,CAAC,oBAAoB,EAAE,kCAAgC,CAAC;YACxD,CAAC,iBAAiB,EAAE,2CAAyC,CAAC;YAC9D,CAAC,0BAA0B,EAAE,6EAA6E,CAAC;YAC3G,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;YAC/F,CAAC,4BAA4B,EAAE,iEAA+D,CAAC;YAC/F,CAAC,kBAAkB,EAAE,mDAAmD,CAAC;YACzE,CAAC,mBAAmB,EAAE,sCAAsC,CAAC;YAC7D,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;YAC/D,CAAC,0BAA0B,EAAE,mDAA+C,CAAC;YAC7E,CAAC,iBAAiB,EAAE,sCAAoC,CAAC;YACzD,CAAC,qBAAqB,EAAE,4DAA0D,CAAC;YACnF,CAAC,2BAA2B,EAAE,2CAAyC,CAAC;YACxE,CAAC,2BAA2B,EAAE,6CAA2C,CAAC;SAC3E,CAAA;QACD,WAAyC,EAAX,2BAAW,EAAX,yBAAW,EAAX,IAAW,EAAE;YAAhC,sBAAe,EAAd,cAAI,EAAE,OAAO,QAAA;YACjB,GAAG,GAAG,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,wCAAwC,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,+BAAwB,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SACpG;QAKK,OAAO,GAAuB;YAClC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;YAC5C,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;YAC9D,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;YAC3C,8EAA8E;YAC9E,2FAA2F;YAC3F,+CAA+C;YAC/C,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;YAC9C,CAAC,eAAe,EAAE,kBAAkB,CAAC;YACrC,CAAC,eAAe,EAAE,UAAU,CAAC;YAC7B,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;YAC/C,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;YACtD,CAAC,aAAa,EAAE,UAAU,CAAC;YAC3B,CAAC,OAAO,EAAE,EAAE,CAAC;SACd,CAAA;QACD,WAAiC,EAAP,mBAAO,EAAP,qBAAO,EAAP,IAAO,EAAE;YAAxB,kBAAW,EAAV,cAAI,EAAE,GAAG,QAAA;YACb,GAAG,GAAG,IAAA,2CAA+B,EAAC,wBAAgB,GAAG,iBAAa,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,mCAA4B,MAAI,kBAAQ,GAAG,CAAE,CAAC,CAAA;SAC/F;QAGK,QAAQ,GAAG,IAAA,2CAA+B,EAAC,2CAAyC,CAAC,CAAA;QAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,mDAA4C,QAAQ,CAAE,CAAC,CAAA;QACpG,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,mCAA4B,QAAQ,CAAE,CAAC,CAAA;QAGtF,MAAM,GAAG,IAAA,2CAA+B,EAAC,sFAAkF,CAAC,CAAA;QAClI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,+BAAwB,MAAM,CAAE,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,iDAA0C,MAAM,CAAE,CAAC,CAAA;QAGjG,QAAQ,GAAG,IAAA,2CAA+B,EAAC,mGAA2F,CAAC,CAAA;QAC7I,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,gCAAyB,QAAQ,CAAE,CAAC,CAAA;QAC1F,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,IAAI,CAAC,yCAAkC,QAAQ,CAAE,CAAC,CAAA;QACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,wDAAiD,QAAQ,CAAE,CAAC,CAAA;QAMjG,EAAE,GAAG,IAAA,2CAA+B,EAAC,4GAAoG,CAAC,CAAA;QAChJ,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QACtG,IAAI,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAE,IAAI,CAAC,sCAA+B,EAAE,CAAE,CAAC,CAAA;QAC3G,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,gCAAyB,EAAE,CAAE,CAAC,CAAA;QAElF,qBAAqB;QACrB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,oBAAY,kCAAsB,OAAG,CAAC;YAAE,IAAI,CAAC,8BAAuB,EAAE,CAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,IAAI,CAAC,kCAA2B,EAAE,CAAE,CAAC,CAAA;QACxF,WAA4C,EAAxB,qDAAwB,EAAxB,sCAAwB,EAAxB,IAAwB,EAAE;YAAnC,KAAK;YACd,IAAI,kCAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,wCAAiC,KAAK,eAAK,kCAAsB,CAAE,CAAC,CAAA;SACtH;QACD,kGAAkG;QAClG,uFAAuF;QACvF,IAAI,CAAC,kCAAsB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,IAAI,CAAC,6EAAsE,kCAAsB,CAAE,CAAC,CAAA;QAIzJ,aAAa,GAAG,IAAA,2CAA+B,EAAC,wEAAoE,CAAC,CAAA;QAC3H,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAAE,IAAI,CAAC,sCAA+B,aAAa,CAAE,CAAC,CAAA;QAGtG,YAAY,GAAG,IAAA,2CAA+B,EAAC,2DAAuD,CAAC,CAAA;QAC7G,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,kEAA2D,YAAY,CAAE,CAAC,CAAA;QACpH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,iDAA0C,YAAY,CAAE,CAAC,CAAA;QAGnG,KAAK,GAAG,IAAA,2CAA+B,EAAC,6EAAyE,CAAC,CAAA;QACxH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YAAE,IAAI,CAAC,6CAAsC,KAAK,CAAE,CAAC,CAAA;QAGlG,SAAS,GAAG,IAAA,2CAA+B,EAAC,kGAA8F,CAAC,CAAA;QACjJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,IAAI,CAAC,oCAA6B,SAAS,CAAE,CAAC,CAAA;QAKtG,OAAO,GAAG,IAAA,2CAA+B,EAAC,mDAAiD,CAAC,CAAA;QAClG,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAAE,IAAI,CAAC,mCAA4B,OAAO,CAAE,CAAC,CAAA;QAE5I,KAAK,GAAG,IAAA,2CAA+B,EAAC,4HAAwH,CAAC,CAAA;QACvK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,KAAK,CAAE,CAAC,CAAA;QAEjH,IAAI,GAAG,IAAA,2CAA+B,EAAC,oDAAkD,CAAC,CAAA;QAChG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,yBAAkB,IAAI,CAAE,CAAC,CAAA;QAErG,IAAI,GAAG,IAAA,2CAA+B,EAAC,0CAAwC,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,IAAI,CAAC,8BAAuB,IAAI,CAAE,CAAC,CAAA;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,sCAA+B,IAAI,CAAE,CAAC,CAAA;QAEnF,GAAG,GAAG,IAAA,2CAA+B,EAAC,uEAAiE,CAAC,CAAA;QAC9G,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,qCAAqC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,0BAAmB,GAAG,CAAE,CAAC,CAAA;QAEjH,OAAO,GAAG,IAAA,2CAA+B,EAAC,kDAAgD,CAAC,CAAA;QACjG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,IAAI,CAAC,gCAAyB,OAAO,CAAE,CAAC,CAAA;QAE3E,GAAG,GAAG,IAAA,2CAA+B,EAAC,wGAAsG,CAAC,CAAA;QACnJ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAE,IAAI,CAAC,+BAAwB,GAAG,CAAE,CAAC,CAAA;QAKlI,MAAM,GAAG,IAAA,8BAAkB,EAAC,6DAA2D,CAAC,CAAA;QAC9F,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,uDAAgD,MAAM,CAAE,CAAC,CAAA;QAKtG,aAAa,GAAG,qGAAmG,CAAA;QACnH,SAAS,GAAG,IAAA,8CAAkC,EAAC,aAAa,EAAE;YAClE,OAAO,EAAE,EAAE,KAAK,EAAE,sDAAoD,EAAS;YAC/E,SAAS,EAAE,EAAE;YACb,0BAA0B,EAAE,IAAI;YAChC,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAA;QACI,QAAQ,GAAG,IAAA,2CAA+B,EAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YAAE,IAAI,CAAC,8CAAuC,QAAQ,CAAE,CAAC,CAAA;QAC1H,6FAA6F;QAC7F,wFAAwF;QACxF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,IAAI,CAAC,oDAA6C,QAAQ,CAAE,CAAC,CAAA;QACnG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,uDAAgD,QAAQ,CAAE,CAAC,CAAA;QAEnI,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAA;;;KAC7E,CAAA;AAjKY,QAAA,qCAAqC,yCAiKjD;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAA,6CAAqC,GAAE;SACpC,IAAI,CAAC,cAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;SACjE,KAAK,CAAC,UAAC,GAAG,IAAO,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;CAC9E"}

package/lib/cjs/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.d.ts

@@ -0,0 +1,29 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression tests for F-0015
+ * (security-audit/findings/F-0015-webhook-outbound-ssrf.md).
+ *
+ * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
+ * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
+ * affected: api/modules/webhooks.ts:145, :214, :270, and the five-method block at api/v1/api.ts:9723.
+ *
+ * Two properties make this worse than a blind SSRF:
+ *  - A non-2xx response body is stored in log.response, and webhook_logs is surfaced to customers for
+ *    debugging — so an internal endpoint's error body is readable by the tenant that configured it.
+ *  - The automation send-webhook action builds its URL at runtime through five nested template
+ *    replacers over action.info.url, so patient-controlled field values can reach the destination.
+ *
+ * And critically: axios@0.30.2 follows redirects by default (maxRedirects: 5). A pre-flight check on
+ * the configured URL is therefore NOT sufficient — a receiver can simply 302 to an internal address
+ * after validation has already passed. T4 exists to prove exactly that, which is why the fix has to
+ * validate at connect time (a guarded agent) rather than as a string check.
+ *
+ * Each test below asserts ABSENCE ("the sentinel was never contacted"), which passes trivially if the
+ * request never happened at all — a missing allowlist entry, a webhook that never fired, a broken
+ * subscription. So each is paired with a positive control that proves the attempt really was made.
+ */
+export declare const webhook_outbound_ssrf_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0015-webhook-outbound-ssrf.test.d.ts.map

package/lib/cjs/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0015-webhook-outbound-ssrf.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAyEtC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B;SAA2B,OAAO;iBAAe,OAAO;mBA0K/F,CAAA"}