gstack/browse/test
Garry Tan 0c915f9705
fix(browse): DNS rebinding protection for SSRF blocklist
validateNavigationUrl is now async — resolves hostname to IP and checks
against blocked metadata IPs. Prevents DNS rebinding where evil.com
initially resolves to a safe IP, then switches to 169.254.169.254.
All callers updated to await. Tests updated for async assertions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 12:23:21 -07:00
..
fixtures feat: 3-tier eval suite with planted-bug outcome testing (EVALS=1) 2026-03-14 01:17:36 -05:00
bun-polyfill.test.ts fix: Windows support — Node.js server fallback for Playwright (#255) 2026-03-20 12:22:11 -07:00
commands.test.ts fix: adjust test key names to avoid redaction pattern collision 2026-03-22 09:58:32 -07:00
config.test.ts fix: Windows support — Node.js server fallback for Playwright (#255) 2026-03-20 12:22:11 -07:00
cookie-import-browser.test.ts feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29) 2026-03-13 00:31:41 -07:00
cookie-picker-routes.test.ts feat: v0.3.2 — project-local state, diff-aware QA, Greptile integration (#36) 2026-03-13 18:10:56 -07:00
find-browse.test.ts feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226) 2026-03-19 18:20:50 -07:00
gstack-config.test.ts feat: smart update check with auto-upgrade, snooze backoff, config CLI (v0.3.9) (#62) 2026-03-14 23:28:02 -07:00
gstack-update-check.test.ts fix: update check cache — 60min UP_TO_DATE TTL + --force flag (v0.4.4) (#110) 2026-03-16 14:14:15 -05:00
handoff.test.ts feat: browse handoff — headless-to-headed browser switching (v0.7.4) (#201) 2026-03-19 00:38:58 -05:00
path-validation.test.ts fix: security hardening + issue triage (v0.8.3) (#205) 2026-03-19 01:58:43 -05:00
platform.test.ts fix: Windows support — Node.js server fallback for Playwright (#255) 2026-03-20 12:22:11 -07:00
snapshot.test.ts feat: QA restructure, browser ref staleness, eval efficiency metrics (v0.4.0) (#83) 2026-03-15 23:55:39 -05:00
test-server.ts feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29) 2026-03-13 00:31:41 -07:00
url-validation.test.ts fix(browse): DNS rebinding protection for SSRF blocklist 2026-03-22 12:23:21 -07:00