admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make log payloads opaque pass-through

Browse Source
This commit is contained in:
npc0-hue
2026-09-03 12:40:17 +08:00
parent 5b82a42cc4
commit bf3c382d15
16 changed files with 63 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform_web/schemas/gameClientBridge.test.ts
+9 -8
View File
@@ -63,17 +63,18 @@ describe("Game Client Bridge safe projection schema", () => {
{ sessionToken: "component-session-material" },
{ componentSession: "component-session-material" },
{ componentKey: "raw-component-key" },
{ sourceSessionId: "component-session-1" },
{ result: { ...safeCommand.result, payload: { dsn: "sqlite:///srv/scum/SCUM.db" } } },
{ result: { ...safeCommand.result, payload: { endpoint: "tcp://127.0.0.1:9999" } } },
{ result: { ...safeCommand.result, payload: { output: "/Users/operator/scum/config.yaml" } } }
{ sourceSessionId: "component-session-1" }
])("rejects forbidden command projection %#", (unsafe) => {
expect(() => parseSafeGameClientBridgeCommand({ ...safeCommand, ...unsafe })).toThrow(/forbidden|sensitive/i);
});
it("rejects credentials nested inside snapshot payloads", () => {
const unsafe = structuredClone(safeSnapshotList);
unsafe.items[0].payload = { players: [{ playerId: "player-1", credential: "raw-password" }] } as unknown as typeof unsafe.items[0]["payload"];
expect(() => parseSafeGameClientBridgeSnapshotList(unsafe)).toThrow(/forbidden/i);
it("preserves sensitive-looking command and snapshot payloads", () => {
expect(parseSafeGameClientBridgeCommand({
...safeCommand,
result: { ...safeCommand.result, payload: { dsn: "sqlite:///srv/scum/SCUM.db", endpoint: "tcp://127.0.0.1:9999", output: "/Users/operator/scum/config.yaml" } }
})).toMatchObject({ result: { payload: { dsn: "sqlite:///srv/scum/SCUM.db", endpoint: "tcp://127.0.0.1:9999", output: "/Users/operator/scum/config.yaml" } } });
const payload = { players: [{ playerId: "player-1", credential: "raw-password", note: "password=opaque" }] };
expect(parseSafeGameClientBridgeSnapshotList({ ...safeSnapshotList, items: [{ ...safeSnapshotList.items[0], payload }] })).toMatchObject({ items: [{ payload }] });
});
});