fix: address protocol probe review findings
This commit is contained in:
@@ -55,26 +55,34 @@ func TestCompleteModelProfileEditorSupportsCursorEditingDeletionAndPaste(t *test
|
||||
}
|
||||
}
|
||||
|
||||
func TestCompleteModelProfileEditorHorizontallyScrollsLongSecretURLWithoutDisclosure(t *testing.T) {
|
||||
func TestCompleteModelProfileEditorMasksEntireUserinfoWhilePreservingScrollAndSavedValue(t *testing.T) {
|
||||
module := &profileManagementModule{}
|
||||
model := openNewProfileEditor(t, module)
|
||||
model = updateRunes(model, "office")
|
||||
model = updateKey(model, "tab")
|
||||
const username = "operator-private"
|
||||
const secret = "credential-never-rendered"
|
||||
const raw = "https://operator:" + secret + "@this-is-a-very-long-proxy-hostname-for-horizontal-scroll.example:8443"
|
||||
const raw = "https://" + username + ":" + secret + "@this-is-a-very-long-proxy-hostname-for-horizontal-scroll.example:8443"
|
||||
model = updateRunes(model, raw)
|
||||
|
||||
end := model.View()
|
||||
assertUsableFrame(t, end, 80, 24, "[focused]", "scroll.example:8443")
|
||||
if strings.Contains(end, secret) || strings.Contains(end, "https://operator") {
|
||||
t.Fatalf("end-scrolled input disclosed credentials or failed to scroll:\n%s", end)
|
||||
for _, literal := range []string{username, secret} {
|
||||
if strings.Contains(end, literal) {
|
||||
t.Fatalf("end-scrolled input disclosed userinfo %q:\n%s", literal, end)
|
||||
}
|
||||
}
|
||||
|
||||
model = editorKey(model, tea.KeyHome)
|
||||
start := model.View()
|
||||
assertUsableFrame(t, start, 80, 24, "https://operator:")
|
||||
if strings.Contains(start, secret) || strings.Contains(start, "scroll.example:8443") {
|
||||
t.Fatalf("home did not scroll to the safe beginning of the input:\n%s", start)
|
||||
assertUsableFrame(t, start, 80, 24, "https://")
|
||||
if strings.Contains(start, username) || strings.Contains(start, secret) || strings.Contains(start, "scroll.example:8443") {
|
||||
t.Fatalf("home did not scroll to the masked beginning of the input:\n%s", start)
|
||||
}
|
||||
|
||||
model = updateKey(model, "ctrl+s")
|
||||
if len(module.intents) != 1 || module.intents[0].Profile.SingleURL != raw {
|
||||
t.Fatalf("editable masking changed saved Profile semantics: %#v", module.intents)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user