@tellescope/sdk 2.0.0-beta.1 → 2.0.0-beta.3

package/src/tests/api_tests/security/proxy-image-unauth-ssrf.test.ts

@@ -2,31 +2,18 @@ require('source-map-support').install();
 
 import http from "http"
 import axios from "axios"
-import { Session } from "../../../sdk"
 import {
-  async_test,
-  log_header,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
+const RAND = () => Math.random().toString(36).slice(2, 10)
 
-/**
- * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
- * prod it is the API server itself — the sentinel below would never be contacted, every assertion
- * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
- */
-const assert_local_api = () => {
-  const hostname = new URL(host).hostname
-  if (!LOCAL_HOSTNAMES.includes(hostname)) {
-    throw new Error(
-      `SSRF tests must run against a local API (got ${host}). `
-      + `127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.`
-    )
-  }
-}
+const LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1']
 
 /**
  * Regression tests: `/v1/proxy-image` must refuse internal and non-image destinations.
@@ -55,10 +42,30 @@ const assert_local_api = () => {
  * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
  * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
  * the vulnerability proof.
+ *
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted and every check here
+ * would pass for the wrong reason. So a non-local API_URL records ONE FAILING check and returns: this
+ * suite goes deliberately red rather than skipping, because a skipped SSRF proof rots silently. It
+ * must not throw: a throw propagates out of run_isolated_in_parallel and aborts every remaining batch.
  */
-export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("proxy-image unauthenticated SSRF")
-  assert_local_api()
+export const proxy_image_ssrf_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  // Before provisioning, deliberately: an early return after setup_isolated_tenant but outside the
+  // try/finally would strand a tenant that nothing in the system can delete.
+  const hostname = new URL(host).hostname
+  if (!LOCAL_HOSTNAMES.includes(hostname)) {
+    record(
+      'SSRF proof runs against a local API',
+      false,
+      `API_URL is ${host}, which is not local. 127.0.0.1 would resolve to the API server rather than `
+      + `this machine, so the sentinel could never be contacted and every check below would pass for `
+      + `the wrong reason. Re-run against a local API; this suite is red, not skipped, on purpose.`,
+    )
+    return checks
+  }
 
   const SENTINEL = `f0025-sentinel-${Date.now()}-${Math.random().toString(36).slice(2)}`
   let sentinelHits = 0
@@ -71,7 +78,34 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }))
   })
 
+  /**
+   * The async_test({ onResult }) equivalent, as a soft Check: a call that REJECTS is a failure
+   * (async_test treats it the same way), and a resolved call passes only when onResult agrees.
+   */
+  const expect_result = async <T,>(label: string, fn: () => Promise<T>, onResult: (r: T) => boolean) => {
+    try {
+      const result = await fn()
+      // The raw value decides the fallback, not JSON.stringify of it.
+      const stringified = JSON.stringify(result)
+      record(label, onResult(result), `result=${stringified === undefined ? String(result) : stringified}`)
+    } catch (e: any) {
+      const message = typeof e?.message === 'string' && e.message !== ''
+        ? e.message
+        : (e === undefined || e === null ? String(e) : JSON.stringify(e))
+      record(label, false, `rejected instead of resolving: ${message}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
   try {
+    tenant = await setup_isolated_tenant({
+      name: `Proxy-image unauthenticated SSRF ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
     await new Promise<void>(resolve => sentinel.listen(0, '127.0.0.1', () => resolve()))
     const sentinelPort = (sentinel.address() as any).port
     const sentinelURL = `http://127.0.0.1:${sentinelPort}/latest/meta-data/iam/security-credentials/`
@@ -93,26 +127,28 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
     }
 
     // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
-    await async_test(
+    await expect_result(
       'proxy-image does not stream an internal non-image resource to an unauthenticated caller',
       call_unauthenticated,
-      {
-        // Positive control: a numeric status proves we actually reached our API rather than failing to
-        // connect (a connection error would make "nothing leaked" true for the wrong reason).
-        onResult: (r: any) => (
-          typeof r.status === 'number'
-          && r.leaked === false
-          && r.sentinelHits === 0
-        ),
-      },
+      // Positive control: a numeric status proves we actually reached our API rather than failing to
+      // connect (a connection error would make "nothing leaked" true for the wrong reason).
+      (r: any) => (
+        typeof r.status === 'number'
+        && r.leaked === false
+        && r.sentinelHits === 0
+      ),
     )
 
     // T2 — the unauthenticated surface itself: the request must be refused outright, and the
     // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
-    await async_test(
+    await expect_result(
       'proxy-image refuses an unauthenticated request without contacting the destination',
       call_unauthenticated,
-      { onResult: (r: any) => r.status >= 400 && r.status < 500 && r.sentinelHits === 0 },
+      // 429 is excluded explicitly: this suite now runs inside the 8-wide isolated pool, where a
+      // shared per-IP throttle could return one and satisfy "some 4xx" without the auth gate ever
+      // having fired. Any other 4xx (401 on the authenticated shape, 404/405 on the retired GET)
+      // is still accepted, as the comment above describes.
+      (r: any) => r.status >= 400 && r.status < 500 && r.status !== 429 && r.sentinelHits === 0,
     )
 
     // Authenticating is not enough on its own — a staff session must not be able to reach an internal
@@ -127,46 +163,53 @@ export const proxy_image_ssrf_tests = async ({ sdk } : { sdk: Session, sdkNonAdm
       return { status: res.status, sentinelHits }
     }
 
-    await async_test(
+    await expect_result(
       'proxy-image refuses a private destination even for an authenticated staff session',
       () => call_authenticated(sentinelURL),
-      { onResult: (r: any) => r.status === 400 && r.sentinelHits === 0 },
+      (r: any) => r.status === 400 && r.sentinelHits === 0,
     )
 
-    await async_test(
+    await expect_result(
       'proxy-image refuses cloud metadata for an authenticated staff session',
       () => call_authenticated('https://169.254.169.254/latest/meta-data/'),
-      { onResult: (r: any) => r.status === 400 },
+      (r: any) => r.status === 400,
     )
 
     // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
-    await async_test(
+    await expect_result(
       'proxy-image refuses a plain http destination',
       () => call_authenticated('http://example.com/logo.png'),
-      { onResult: (r: any) => r.status === 400 },
+      (r: any) => r.status === 400,
     )
 
-    await async_test(
+    await expect_result(
       'proxy-image refuses a non-443 port',
       () => call_authenticated('https://example.com:8443/logo.png'),
-      { onResult: (r: any) => r.status === 400 },
+      (r: any) => r.status === 400,
     )
   } finally {
     sentinel.close()
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
   }
+
+  return checks
 }
 
-if (require.main === module) {
-  console.log(`🌐 Using API URL: ${host}`)
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
+/** Asserting wrapper, for standalone runs. */
+export const proxy_image_ssrf_tests = async () => {
+  assert_checks('Proxy-image unauthenticated SSRF', await proxy_image_ssrf_checks())
+}
 
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
-  }
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'Proxy-image unauthenticated SSRF',
+  run: proxy_image_ssrf_checks,
+}
 
-  runTests()
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  proxy_image_ssrf_tests()
     .then(() => {
       console.log("✅ proxy-image SSRF test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/register_business_id_injection.test.ts

@@ -1,26 +1,39 @@
 require('source-map-support').install();
 
 import axios from "axios"
-import { Session } from "../../../sdk"
+import { wait } from "@tellescope/testing"
 import {
-  assert,
-  log_header,
-  wait,
-} from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+  assert_checks,
+  Check,
+  IsolatedSuite,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
-const post = async (path: string, body: any, headers: Record<string, string> = {}) => {
-  try {
-    const res = await axios.post(`${host}${path}`, body, {
-      validateStatus: () => true,
-      headers,
-    })
-    return { status: res.status, data: res.data }
-  } catch (err: any) {
-    return { status: err?.response?.status, data: err?.response?.data }
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * POST /v1/users/register, retrying a 429.
+ *
+ * The endpoint is throttled at roughly 1/sec on a `user-register-<ip>` namespace that no tenant
+ * teardown clears and that every concurrently running suite shares, so a 429 here is contention
+ * between suites, not a result. (Deliberately a local copy of organization_signup.test.ts's helper
+ * rather than a shared export: the two suites stay uncoupled.)
+ */
+const register_request = async (data: Record<string, any>) => {
+  const send = () => axios.request({
+    method: 'post', url: `${host}/v1/users/register`,
+    data,
+    validateStatus: () => true,
+  })
+
+  let result = await send()
+  for (let attempt = 0; attempt < 5 && result.status === 429; attempt++) {
+    await wait(undefined, 1200)
+    result = await send()
   }
+  return result
 }
 
 /**
@@ -36,99 +49,125 @@ const post = async (path: string, body: any, headers: Record<string, string> = {
  * caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
  * globalUnique: ['email'] enforcement that only runs in the generic create route.
  *
- * The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
- * anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
- * uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
- * throws when the email is absent from the caller's tenant).
+ * The "victim org" is this suite's OWN provisioned tenant (tenant.businessId): an org the
+ * anonymous caller was never invited to. Its admin is used purely to OBSERVE whether an uninvited
+ * user record materialized inside the org (getOne({ email }) is org-scoped and throws when the
+ * email is absent from the caller's tenant). Running on a throwaway tenant rather than the shared
+ * fixture means a failing (vulnerable) run plants its user in an org that is then torn down.
  *
  * Expected results:
- *   - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
- *     proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
+ *   - VULNERABLE code: the checks FAIL — the planted user appears inside the victim org,
+ *     proving the exploit ("EXPLOIT CONFIRMED" in the failure detail).
  *   - FIXED code: register ignores the caller-supplied businessId (self-signups are created
  *     org-less and duplicates are rejected globally), so nothing appears in the victim org and
- *     the assertions PASS.
+ *     the checks PASS.
  *
- * Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
- * email constraint. NOTE: on the FIXED path these registrations create org-less user records
- * that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
- * legitimate "root register, no org" signup behavior.
+ * Uses unique emails per run so re-runs never collide on the platform-wide unique email
+ * constraint. NOTE: on the FIXED path these registrations create org-less user records that
+ * neither an org-scoped admin nor the tenant teardown (which deletes by businessId) can remove —
+ * harmless residue (unique emails), inherent to the legitimate "root register, no org" signup.
  */
-export const register_business_id_injection_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
-  log_header("register businessId injection")
-
-  const victimBusinessId = sdk.userInfo.businessId
-  const password = 'testpassword123!'
-  const termsVersion = '1'
-
-  // ==================================================================================
-  // Scenario 1 — uninvited org join
-  // An anonymous caller registers with businessId set to the victim org. On vulnerable
-  // code this creates a Business user INSIDE the victim org that no one invited.
-  // ==================================================================================
-  const email1 = `security+reg-inject-${Date.now()}@wearehackerone.com`
-
-  const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
-  assert(before === null, `precondition failed: ${email1} already present in victim org`, 'precondition: victim org has no such user')
-
-  const res1 = await post('/v1/users/register', { email: email1, password, termsVersion, businessId: victimBusinessId })
-  console.log(`   register(businessId=victim) -> HTTP ${res1.status}`)
-
-  const planted1: any = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
-  const injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId
-
-  // Clean up BEFORE asserting (a failed assert calls process.exit(1) and would skip cleanup).
-  if (planted1?.id) await sdk.api.users.deleteOne(planted1.id).catch(() => {})
+export const register_business_id_injection_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
 
-  assert(
-    !injectedIntoVictimOrg,
-    `❌ EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=${victimBusinessId} created user `
-      + `${email1} (accountType=${planted1?.accountType}) inside the victim org — no invite required`,
-    '✅ register ignores caller-supplied businessId — no user injected into victim org',
-  )
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
 
-  await wait(undefined, 1200) // register endpoint rate-limits ~1/sec per IP
-
-  // ==================================================================================
-  // Scenario 2 — cross-org duplicate for the same email
-  // First register with NO businessId (the legitimate "root register, no org" record —
-  // the "oldest" account in the report). Then register the SAME email WITH the victim
-  // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
-  // so a SECOND user record for the same email is created inside the victim org.
-  // ==================================================================================
-  const email2 = `security+reg-dup-${Date.now()}@wearehackerone.com`
-
-  const resRoot = await post('/v1/users/register', { email: email2, password, termsVersion })
-  console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)
-
-  await wait(undefined, 1200)
-
-  const resDup = await post('/v1/users/register', { email: email2, password, termsVersion, businessId: victimBusinessId })
-  console.log(`   register(same email, businessId=victim) -> HTTP ${resDup.status}`)
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `register businessId injection ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    const victimBusinessId = tenant.businessId
+    const password = 'testpassword123!'
+    const termsVersion = '1'
+
+    // ==================================================================================
+    // Scenario 1 — uninvited org join
+    // An anonymous caller registers with businessId set to the victim org. On vulnerable
+    // code this creates a Business user INSIDE the victim org that no one invited.
+    // ==================================================================================
+    const email1 = `dontsend+reg-inject-${Date.now()}-${RAND()}@tellescope.com`
+
+    const before = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+    record(
+      'precondition: victim org has no such user',
+      before === null,
+      before === null ? `${email1} absent from the victim org` : `precondition failed: ${email1} already present in victim org`,
+    )
+
+    const res1 = await register_request({ email: email1, password, termsVersion, businessId: victimBusinessId })
+    console.log(`   register(businessId=victim) -> HTTP ${res1.status}`)
+
+    const planted1: any = await sdk.api.users.getOne({ email: email1 }).catch(() => null)
+    const injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId
+
+    record(
+      '✅ register ignores caller-supplied businessId — no user injected into victim org',
+      !injectedIntoVictimOrg,
+      injectedIntoVictimOrg
+        ? `❌ EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=${victimBusinessId} created user `
+          + `${email1} (accountType=${planted1?.accountType}) inside the victim org — no invite required`
+        : `register -> HTTP ${res1.status}; no ${email1} user inside the victim org`,
+    )
+
+    await wait(undefined, 1200) // register endpoint rate-limits ~1/sec per IP
+
+    // ==================================================================================
+    // Scenario 2 — cross-org duplicate for the same email
+    // First register with NO businessId (the legitimate "root register, no org" record —
+    // the "oldest" account in the report). Then register the SAME email WITH the victim
+    // businessId. On vulnerable code the scoped duplicate check misses the org-less record,
+    // so a SECOND user record for the same email is created inside the victim org.
+    // ==================================================================================
+    const email2 = `dontsend+reg-dup-${Date.now()}-${RAND()}@tellescope.com`
+
+    const resRoot = await register_request({ email: email2, password, termsVersion })
+    console.log(`   register(no businessId) -> HTTP ${resRoot.status}`)
+
+    await wait(undefined, 1200)
+
+    const resDup = await register_request({ email: email2, password, termsVersion, businessId: victimBusinessId })
+    console.log(`   register(same email, businessId=victim) -> HTTP ${resDup.status}`)
+
+    const planted2: any = await sdk.api.users.getOne({ email: email2 }).catch(() => null)
+    const duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId
+
+    record(
+      '✅ register enforces global email uniqueness — no cross-org duplicate created',
+      !duplicateInVictimOrg,
+      duplicateInVictimOrg
+        ? `❌ EXPLOIT CONFIRMED: same email ${email2} registered into a second org — duplicate user `
+          + `(accountType=${planted2?.accountType}) created in victim org ${victimBusinessId}`
+        : `register(no org) -> HTTP ${resRoot.status}, register(businessId=victim) -> HTTP ${resDup.status}; `
+          + `no ${email2} user inside the victim org`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
 
-  const planted2: any = await sdk.api.users.getOne({ email: email2 }).catch(() => null)
-  const duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId
+  return checks
+}
 
-  if (planted2?.id) await sdk.api.users.deleteOne(planted2.id).catch(() => {})
+/** Asserting wrapper, for standalone runs. */
+export const register_business_id_injection_tests = async () => {
+  assert_checks('register businessId injection', await register_business_id_injection_checks())
+}
 
-  assert(
-    !duplicateInVictimOrg,
-    `❌ EXPLOIT CONFIRMED: same email ${email2} registered into a second org — duplicate user `
-      + `(accountType=${planted2?.accountType}) created in victim org ${victimBusinessId}`,
-    '✅ register enforces global email uniqueness — no cross-org duplicate created',
-  )
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = {
+  name: 'register businessId injection',
+  run: register_business_id_injection_checks,
 }
 
 // Allow running this test file independently
 if (require.main === module) {
-  const sdk = new Session({ host })
-  const sdkNonAdmin = new Session({ host })
-
-  const runTests = async () => {
-    await setup_tests(sdk, sdkNonAdmin)
-    await register_business_id_injection_tests({ sdk, sdkNonAdmin })
-  }
-
-  runTests()
+  console.log(`🌐 Using API URL: ${host}`)
+  register_business_id_injection_tests()
     .then(() => {
       console.log("✅ register businessId injection test suite completed successfully")
       process.exit(0)

package/src/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.ts

@@ -5,6 +5,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -182,6 +183,9 @@ export const rich_text_answer_sanitized_on_write_tests = async () => {
   assert_checks('Rich Text answers sanitized on write', await rich_text_answer_sanitized_on_write_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Rich Text answers sanitized on write', run: rich_text_answer_sanitized_on_write_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts

@@ -208,6 +208,133 @@ export const sanitize_user_html_with_iframes_tests = async () => {
   if (!endToEnd.includes('<iframe')) fail(`patient markup not escaped to inert text: ${endToEnd}`)
   if ((endToEnd.toLowerCase().match(/<iframe/g) || []).length !== 1) fail(`patient-injected iframe became a live frame: ${endToEnd}`)
 
+  // ---------------------------------------------------------------------------------------------
+  // 7. sanitize-html 2.18.0 behaviour pins
+  //
+  // Added with the 2.17.7 -> 2.18.0 bump. 2.18.0 changes how markup *inside a disallowed tag* is
+  // emitted: where 2.17.7 entity-escaped it into visible literal text, 2.18.0 parses it and runs it
+  // back through the allowlist. That is a rendering change on every surface, so the vectors it
+  // could plausibly reopen are pinned here rather than left to a future release to rediscover.
+  // ---------------------------------------------------------------------------------------------
+
+  // --- meta refresh -------------------------------------------------------------------------
+  // <meta> is not allowlisted by either shared sanitizer, so an http-equiv="refresh" redirect must
+  // never survive. The portal's custom-page sanitizer allowlists <meta> for charset/name/content
+  // and deliberately omits http-equiv for exactly this reason (CustomPage.tsx), which is why this
+  // vector is worth pinning on the shared pair too.
+  const metaRefreshCases: [string, string][] = [
+    ['lowercase', `<meta http-equiv="refresh" content="0;url=https://evil.example">`],
+    ['uppercase', `<META HTTP-EQUIV="REFRESH" CONTENT="0;url=https://evil.example">`],
+    ['nested in allowed block', `<div><meta http-equiv="refresh" content="0;url=https://evil.example"><p>after</p></div>`],
+  ]
+  for (const [name, payload] of metaRefreshCases) {
+    for (const [fnName, fn] of [['with_iframes', sanitize_user_html_with_iframes], ['base', sanitize_user_html]] as const) {
+      const out = fn(payload).toLowerCase()
+      if (out.includes('<meta')) fail(`meta survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('http-equiv')) fail(`http-equiv survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('evil.example')) fail(`meta refresh target survived [${fnName}/${name}] -> ${out}`)
+    }
+  }
+  // the redirect is dropped without taking the surrounding content with it
+  const metaSibling = sanitize_user_html_with_iframes(`<div><meta http-equiv="refresh" content="0;url=https://evil.example"><p>after</p></div>`)
+  if (!metaSibling.includes('<p>after</p>')) fail(`content after a dropped meta refresh was lost: ${metaSibling}`)
+
+  // --- svg:animate --------------------------------------------------------------------------
+  // SMIL animation can rewrite an attribute after sanitization: <animate attributeName="href"
+  // values="javascript:..."> turns an inert <a> into a javascript: link at render time, which no
+  // amount of href filtering catches. <svg> is not allowlisted, so animate must never survive —
+  // and with 2.18.0 now re-parsing disallowed-tag contents, "the parent is dropped" is no longer
+  // on its own enough to assume the child went with it.
+  const svgAnimateCases: [string, string][] = [
+    ['animate onbegin', `<svg><animate onbegin="alert(1)" attributeName="x" dur="1s"></svg>`],
+    ['animate href values', `<svg><a><animate attributeName="href" values="javascript:alert(1)"/><text>x</text></a></svg>`],
+    ['set href to', `<svg><a><set attributeName="href" to="javascript:alert(1)"/><text>x</text></a></svg>`],
+    ['animate onrepeat', `<svg><animate attributeName="x" begin="0s" onrepeat="alert(1)"/></svg>`],
+    ['animate inside dropped iframe', `<iframe><svg><a><animate attributeName="href" values="javascript:alert(1)"/><text>x</text></a></svg></iframe>`],
+  ]
+  for (const [name, payload] of svgAnimateCases) {
+    for (const [fnName, fn] of [['with_iframes', sanitize_user_html_with_iframes], ['base', sanitize_user_html]] as const) {
+      const out = fn(payload).toLowerCase()
+      if (out.includes('<animate') || out.includes('<set')) fail(`SMIL animation element survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('<svg')) fail(`svg survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('attributename')) fail(`attributeName survived [${fnName}/${name}] -> ${out}`)
+      if (out.includes('javascript:')) fail(`javascript: payload survived [${fnName}/${name}] -> ${out}`)
+      if (/\son[a-z]+\s*=/.test(out.replace(/"[^"]*"/g, '""'))) fail(`SMIL event handler survived [${fnName}/${name}] -> ${out}`)
+    }
+  }
+
+  // --- noscript (the nonTextTags vector) ------------------------------------------------------
+  // The classic noscript context-confusion payload: a browser parses <noscript> contents as raw
+  // text when scripting is enabled and as markup when it isn't, so a sanitizer that disagrees with
+  // the renderer can be walked out of the attribute it thinks it is inside. Neither shared
+  // sanitizer sets nonTextTags, but the portal's custom-page sanitizer lists 'noscript' there
+  // (CustomPage.tsx), so the dependency's handling of the tag is pinned here.
+  const noscriptCases: [string, string][] = [
+    ['attribute break-out', `<noscript><p title="</noscript><img src=x onerror=alert(1)>">`],
+    ['style comment mXSS', `<noscript><style><!--</style><img src=x onerror=alert(1)>`],
+    ['plain content', `<noscript>hidden</noscript><p>after</p>`],
+    ['markup content', `<noscript><b>bold</b></noscript><p>after</p>`],
+    ['inside dropped iframe', `<iframe><noscript><p title="</noscript><img src=x onerror=alert(1)>"></iframe>`],
+  ]
+  for (const [name, payload] of noscriptCases) {
+    for (const [fnName, fn] of [['with_iframes', sanitize_user_html_with_iframes], ['base', sanitize_user_html]] as const) {
+      const out = fn(payload)
+      if (out.toLowerCase().includes('<noscript')) fail(`noscript survived [${fnName}/${name}] -> ${out}`)
+      // The breakout payload may legitimately remain as inert escaped text inside an attribute
+      // value; what must never happen is it coming back as a live handler. Values are blanked
+      // before the handler check for exactly that reason.
+      if (/\son[a-z]+\s*=/.test(out.toLowerCase().replace(/"[^"]*"/g, '""').replace(/'[^']*'/g, "''"))) {
+        fail(`live event handler escaped the noscript context [${fnName}/${name}] -> ${out}`)
+      }
+      if (out.toLowerCase().includes('<script')) fail(`script escaped the noscript context [${fnName}/${name}] -> ${out}`)
+    }
+  }
+  // content after a noscript block is not swallowed (the "page ends early" regression)
+  const afterNoscript = sanitize_user_html(`<noscript>a</noscript><p>para1</p><div>para2</div><span>tail</span>`)
+  for (const frag of ['<p>para1</p>', '<div>para2</div>', '<span>tail</span>']) {
+    if (!afterNoscript.includes(frag)) fail(`content after noscript was swallowed (missing ${frag}): ${afterNoscript}`)
+  }
+
+  // --- disallowed-iframe fallback content (the actual 2.18.0 delta) ---------------------------
+  // This is what changed. In sanitize_user_html (no iframe in allowedTags) the markup inside a
+  // dropped <iframe> used to be emitted as escaped literal text; from 2.18.0 it is parsed and
+  // allowlisted instead, so a patient reading a form answer now sees bold text where they used to
+  // see "<b>FB</b>". Safe — the allowlist still applies — but it is a visible change, so both the
+  // containment and the rendering are pinned.
+  const baseFallback = sanitize_user_html(`<iframe src="http://evil.example"><b>FB</b></iframe>`)
+  if (baseFallback.toLowerCase().includes('<iframe')) fail(`base sanitizer kept the frame: ${baseFallback}`)
+  if (baseFallback.toLowerCase().includes('evil.example')) fail(`base sanitizer kept the frame src: ${baseFallback}`)
+  // The markup form, not just the characters "FB": on 2.17.7 this came back as the escaped text
+  // &lt;b&gt;FB&lt;/b&gt;, which also contains "FB". Asserting the live tag is what makes this pin
+  // the 2.18.0 behaviour rather than pass identically on either version.
+  if (!baseFallback.includes('<b>FB</b>')) fail(`fallback markup was not parsed back into live markup: ${baseFallback}`)
+  if (baseFallback.includes('&lt;b&gt;')) fail(`fallback markup is still escaped (pre-2.18.0 behaviour): ${baseFallback}`)
+
+  // The hostile versions of the same shape must still come out inert, by the allowlist rather
+  // than by escaping.
+  const fallbackAttacks: [string, string][] = [
+    ['img onerror', `<iframe><img src=x onerror=alert(1)></iframe>`],
+    ['script', `<iframe><script>alert(1)</script></iframe>`],
+    ['nested iframe', `<iframe><iframe src="https://evil.example"></iframe></iframe>`],
+    ['javascript link', `<iframe><a href="javascript:alert(1)">x</a></iframe>`],
+    ['object', `<iframe><object data="javascript:alert(1)"></object></iframe>`],
+    ['base href', `<iframe><base href="https://evil.example"></iframe>`],
+  ]
+  for (const [name, payload] of fallbackAttacks) {
+    const out = sanitize_user_html(payload)
+    if (!has_no_executable_vector_allowing_iframe(out) || out.toLowerCase().includes('<iframe')) {
+      fail(`iframe fallback content reopened a vector [${name}] -> ${out}`)
+    }
+  }
+
+  // sanitize_user_html_with_iframes is unaffected: exclusiveFilter removes a disallowed frame AND
+  // its children, so fallback markup never reaches the escaping path at all. Asserted explicitly
+  // so the two functions' different handling stays deliberate.
+  for (const [name, payload] of [...fallbackAttacks, ['bold fallback', `<iframe src="http://evil.example"><b>FB</b></iframe>`] as [string, string]]) {
+    const out = sanitize_user_html_with_iframes(payload)
+    if (out !== '') fail(`with_iframes should drop a disallowed frame and all its content [${name}] -> ${out}`)
+  }
+
   console.log("✅ sanitize_user_html_with_iframes XSS regression tests passed")
 }