Vance Ingalls
20be2ea1c2
## Summary - Run `oxfmt .` across the entire codebase to establish formatted baseline - 299 files changed — mechanical formatting only, no logic changes - Double quotes, semicolons, 2-space indent, trailing commas, 100 print width Part 3/4 of [VA-851](https://linear.app/heygen/issue/VA-851/pre-migration-configure-eslint-prettier-and-conventional-commits) ## Test plan - [x] `pnpm format:check` — all 426 files pass - [x] `pnpm -r typecheck` — all packages pass - [x] `pnpm build` — all packages build - [x] All 348 tests pass
103 lines
3.1 KiB
TypeScript
103 lines
3.1 KiB
TypeScript
function assert(condition: unknown, message: string): void {
|
|
if (!condition) {
|
|
throw new Error(message);
|
|
}
|
|
}
|
|
|
|
const ALLOWED_HOSTS = new Set(["runtime.example.com"]);
|
|
const ALLOWED_PATH_PREFIX = "/static/hyperframes-runtime/";
|
|
|
|
function isAllowedRuntimeUrl(candidate: string): boolean {
|
|
try {
|
|
const parsed = new URL(candidate);
|
|
return (
|
|
parsed.protocol === "https:" &&
|
|
ALLOWED_HOSTS.has(parsed.hostname.toLowerCase()) &&
|
|
parsed.pathname.startsWith(ALLOWED_PATH_PREFIX) &&
|
|
parsed.pathname.endsWith(".js")
|
|
);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function isGuardedPreviewMessage(data: unknown): boolean {
|
|
if (!data || typeof data !== "object") {
|
|
return false;
|
|
}
|
|
const record = data as { source?: unknown; type?: unknown };
|
|
const source = typeof record.source === "string" ? record.source : null;
|
|
const type = typeof record.type === "string" ? record.type : null;
|
|
const guardedTypes = new Set([
|
|
"state",
|
|
"timeline",
|
|
"element-picked",
|
|
"element-picked-many",
|
|
"element-pick-candidates",
|
|
"pick-mode-cancelled",
|
|
]);
|
|
if (!type || !guardedTypes.has(type)) {
|
|
return false;
|
|
}
|
|
return source === "hf-preview";
|
|
}
|
|
|
|
const allowedRuntimeFixtures = [
|
|
"https://runtime.example.com/static/hyperframes-runtime/hyperframe.runtime.iife.js",
|
|
"https://runtime.example.com/static/hyperframes-runtime/v2026.02.20/hyperframe.runtime.iife.js",
|
|
];
|
|
|
|
const blockedRuntimeFixtures = [
|
|
"http://runtime.example.com/static/hyperframes-runtime/hyperframe.runtime.iife.js",
|
|
"javascript:alert(1)",
|
|
"data:text/javascript,alert(1)",
|
|
"https://evil.example/static/hyperframes-runtime/hyperframe.runtime.iife.js",
|
|
"https://runtime.example.com/static/other/hyperframe.runtime.iife.js",
|
|
"https://runtime.example.com/static/hyperframes-runtime/hyperframe.runtime.iife.css",
|
|
];
|
|
|
|
for (const fixture of allowedRuntimeFixtures) {
|
|
assert(isAllowedRuntimeUrl(fixture), `Expected runtime URL to be allowed: ${fixture}`);
|
|
}
|
|
|
|
for (const fixture of blockedRuntimeFixtures) {
|
|
assert(!isAllowedRuntimeUrl(fixture), `Expected runtime URL to be blocked: ${fixture}`);
|
|
}
|
|
|
|
const allowedMessages = [
|
|
{ type: "state", source: "hf-preview" },
|
|
{ type: "timeline", source: "hf-preview" },
|
|
{ type: "element-picked", source: "hf-preview" },
|
|
];
|
|
const blockedMessages = [
|
|
{ type: "state", source: "hf-parent" },
|
|
{ type: "timeline", source: "evil-origin" },
|
|
{ type: "element-picked", source: "hf-parent" },
|
|
{ type: "pick-mode-cancelled", source: null },
|
|
{ type: "unknown-type", source: "hf-preview" },
|
|
];
|
|
|
|
for (const fixture of allowedMessages) {
|
|
assert(
|
|
isGuardedPreviewMessage(fixture),
|
|
`Expected message fixture to pass guard: ${JSON.stringify(fixture)}`,
|
|
);
|
|
}
|
|
|
|
for (const fixture of blockedMessages) {
|
|
assert(
|
|
!isGuardedPreviewMessage(fixture),
|
|
`Expected message fixture to fail guard: ${JSON.stringify(fixture)}`,
|
|
);
|
|
}
|
|
|
|
console.log(
|
|
JSON.stringify({
|
|
event: "hyperframe_runtime_security_fixtures_verified",
|
|
allowedRuntimeFixtures: allowedRuntimeFixtures.length,
|
|
blockedRuntimeFixtures: blockedRuntimeFixtures.length,
|
|
allowedMessages: allowedMessages.length,
|
|
blockedMessages: blockedMessages.length,
|
|
}),
|
|
);
|