mirror of
https://github.com/morluto/rea
synced 2026-10-27 14:42:18 -04:00
38f92d108e
Inspect AST property segments instead of flattened suffixes. Reject dotted-key and suffix collisions while retaining page-declared trust and source evidence through the CLI. Refs: #4205, #4279 Co-authored-by: Geekwolf <geekwolf@163.com>
81 lines
2.3 KiB
TypeScript
81 lines
2.3 KiB
TypeScript
import { expect } from "vitest";
|
|
|
|
import { startFakeCdpBrowser } from "../../fixtures/fakeCdpBrowser.js";
|
|
import { cliTest } from "../../support/cli/cliFixture.js";
|
|
|
|
cliTest(
|
|
"keeps WebMCP receiver segments exact through the public CLI",
|
|
async ({ cli }) => {
|
|
const source = `
|
|
navigator.modelContext.registerTool({ name: "navigator" });
|
|
const app = { analyticsmodelContext: { registerTool() {} } };
|
|
app.analyticsmodelContext.registerTool({ name: "nested suffix" });
|
|
window["modelContext.registerTool"]({ name: "dotted property" });
|
|
`;
|
|
const browser = await startFakeCdpBrowser({
|
|
commandResult: ({ method }) =>
|
|
method === "Debugger.getScriptSource"
|
|
? { scriptSource: source }
|
|
: undefined,
|
|
});
|
|
try {
|
|
const result = await cli.run({
|
|
arguments: [
|
|
"analyze-web-bundle",
|
|
browser.endpoint,
|
|
"allowed-page",
|
|
"--allowed-origins",
|
|
browser.allowedOrigin,
|
|
"--observation-ms",
|
|
"0",
|
|
"--json",
|
|
],
|
|
});
|
|
expect(result.exitCode, result.stdout).toBe(0);
|
|
expect(result.json).toMatchObject({
|
|
normalized_result: {
|
|
observations: {
|
|
webmcp_declarations: [
|
|
expect.objectContaining({
|
|
name: "navigator",
|
|
trust: "page-declared-untrusted",
|
|
}),
|
|
],
|
|
},
|
|
},
|
|
});
|
|
|
|
const inspected = await cli.run({
|
|
arguments: [
|
|
"inspect-web-page",
|
|
browser.endpoint,
|
|
"allowed-page",
|
|
"--allowed-origins",
|
|
browser.allowedOrigin,
|
|
"--observation-ms",
|
|
"0",
|
|
"--include-script-sources",
|
|
"--json",
|
|
],
|
|
});
|
|
expect(inspected.exitCode, inspected.stdout).toBe(0);
|
|
expect(inspected.json).toMatchObject({
|
|
normalized_result: {
|
|
scripts: {
|
|
items: expect.arrayContaining([
|
|
expect.objectContaining({
|
|
source: expect.objectContaining({
|
|
artifact: expect.objectContaining({ text: source }),
|
|
}),
|
|
}),
|
|
]),
|
|
},
|
|
},
|
|
});
|
|
expect(browser.activeConnectionCount()).toBe(0);
|
|
} finally {
|
|
await browser.close();
|
|
}
|
|
},
|
|
);
|