Security tests
tests/security/ is a dedicated suite for regressions that are easy to reintroduce silently — SSRF bypasses, secret leaks, and sandbox weakening. Each file pins one specific failure mode.
| File | Guards against |
|---|---|
ssrf.test.ts | The general SSRF allow-list/deny-list in shared/protocol/url-validation’s validateURL regressing — cloud-metadata endpoints (AWS 169.254.169.254, GCP metadata.google.internal), the Kubernetes API (kubernetes.default), IPv6 loopback ([::1]) and unique-local ([fc00::1]), 0.0.0.0, and disallowed schemes like javascript://. |
ai-lab-localhost-policy.test.ts | AI Lab’s narrow localhost SSRF carve-out (allowLocalhost derived from isLocalProvider) leaking into cloud providers — cloud providers (OpenAI, Anthropic, OpenRouter) must never reach localhost/127.0.0.1/[::1] even via a user-typed base-URL override, while only local runtimes (Ollama, OpenAI-compatible) may reach loopback, and LAN/private ranges stay blocked even for those. |
socketio-dns-pinning.test.ts | A DNS-rebind / TOCTOU SSRF window in the Electron Socket.IO handler: a one-shot pre-flight check used to validate the URL but then hand the raw URL to socket.io-client, which re-resolves DNS at connect time and on every reconnect. The handler now resolves and validates once via resolveSafeAddress and pins the transport (ws and xhr-polling) to that address with an agent-level lookup override. |
sse-proxy-routing.test.ts | SSE connections bypassing the Worker’s SSRF/header-policy chokepoint in web mode. The interactive SSE client must always route through /api/proxy; OWS workflows do not execute SSE calls. |
http-executor-no-fallback.test.ts | The renderer’s HTTP executor calling axios() directly against an upstream URL in web mode — bypassing the Worker’s SSRF guard, header policy, auth gate, and rate limiter — instead of using the Worker transport. |
ai-redaction.test.ts | Secrets (JWTs, sk-… bearer tokens, Authorization headers in any case variant) surviving in AI-assistant prompt/context payloads, using property-style tests over randomized tokens to pin redactBody/redactHeaders/detectUnredactedSecrets. |
capture-redaction.test.ts | A captured HTTP session leaking plaintext secrets — bearer tokens, cookies, JWTs in the body, provider-prefixed API keys — including ones smuggled into non-denylisted locations like query strings, iframe bodies, Location headers, or Referer — when exported to HAR or OpenCollection format. |
secret-storage-routing.test.ts | Secret-bearing keys (Kafka/MQTT SASL passwords, TLS passphrases, Schema Registry Basic-auth password) silently persisting as plaintext in localStorage instead of the encrypted electron-store on desktop; a Record<Field, true> map fails to compile if a new secret field is added without being routed through the sensitive-key path. |
path-traversal.test.ts | Path-traversal escapes (e.g. ../../etc/passwd) from Electron’s allowed storage directories (userData, documents, home), pinning isPathSafe in electron/main/storage/file-operations.ts. |
response-viewer-sandbox.test.ts | The HTTP response Preview tab’s srcDoc iframe combining sandbox="allow-scripts" with allow-same-origin, which together would let a response-embedded script execute in the renderer’s own origin and reach cookies, storage, and the same-origin /api proxy. |
visualizer-sandbox.test.tsx | The Visualizer’s iframe (VisualizerFrame, rendering a user- or collection-supplied template) losing its sandbox="allow-scripts"-only isolation or its strict CSP (default-src 'none', img-src data: only, form-action 'none') that blocks outbound egress from injected scripts. |