RomanNum3ral
/
gstack
mirror of https://github.com/garrytan/gstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge 3095f39ef5 into e284c8e0cd

This commit is contained in:
Gus 2026-07-14 20:35:43 -03:00 committed by GitHub
parent e284c8e0cd 3095f39ef5
commit 598241fea7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
browse/src/write-commands.ts
View File

@ -249,11 +249,11 @@ export async function handleWriteCommand(
if (!filePath) throw new Error('Usage: browse load-html <file> [--wait-until load|domcontentloaded|networkidle] [--tab-id <N>] | load-html --from-file <payload.json> [--tab-id <N>]');
// Extension allowlist
const ALLOWED_EXT = ['.html', '.htm', '.xhtml', '.svg'];
const ALLOWED_EXT = ['.html', '.htm', '.xhtml'];
const ext = path.extname(filePath).toLowerCase();
if (!ALLOWED_EXT.includes(ext)) {
throw new Error(
`load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml/.svg, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`
`load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`
);
}

13
browse/test/commands.test.ts
View File

@ -2298,6 +2298,19 @@ describe('load-html', () => {
}
});
test('load-html rejects .svg files', async () => {
const svgPath = path.join(tmpDir, `load-html-test-${Date.now()}.svg`);
fs.writeFileSync(svgPath, '<svg xmlns="http://www.w3.org/2000/svg"><text>hi</text></svg>');
try {
await handleWriteCommand('load-html', [svgPath], bm);
expect(true).toBe(false);
} catch (err: any) {
expect(err.message).toMatch(/does not appear to be HTML/);
} finally {
try { fs.unlinkSync(svgPath); } catch {}
}
});
test('load-html rejects file outside safe dirs', async () => {
try {
await handleWriteCommand('load-html', ['/etc/passwd.html'], bm);