Files

T

Build and Push Container / build-and-push (push) Successful in 26s

Details

All green. Final report:

**Phase 02 — final verification pass** (both tasks already in `.agents/phases/complete/02_simulate_fetch_commands/`)
- Verified: no `fetch(` remains in `src/` (grep exit 1) or in built `dist/*.js`
- Verified: `simulatedCurlOutput()` / `simulatedWgetOutput()` in `src/terminal-commands.js` (lines 63/73), wired into `src/terminal.js` curl/wget branches
- Verified: regression test `curl/wget are simulated — no real network request leaves the origin` in `tests/e2e/02-terminal.spec.js` — asserts simulated bodies, `web_navigator` toast + localStorage persistence, and zero non-`baseURL` requests
- Tests: `./build.sh` → OK; `npm test` → **46 passed, 0 failed** (≥46 required); `bash .agents/validate.sh` → **exit 0** (E2E + repo-hygiene gates)
- No linter configured beyond validate.sh (vanilla JS, LOCKED no-toolchain)
- Completion criteria: ①no `fetch(` ✅ ②simulators present ✅ ③regression tests present & passing ✅ ④build+test 46 green ✅ ⑤no behavior change (page/terminal/vim/achievements/menu suites all green) ✅
- Documentation: full README/AGENTS.md review — both already updated in working tree and consistent with the project (simulated curl/wget, validate.sh gate, Podman build flow vs Dockerfile, Node ≥20 matches `@playwright/test` engines, M-4 header gap correctly documented as pending Phase 03) — **verified consistent, no changes needed**
- Note: `PLAN.md` still says "44 tests" (now 46) but PLAN is locked — flagged for the harness/user, not edited
- Next pending phase: `03_nginx_security_headers`

2026-10-22 23:14:49 -04:00

2.2 KiB

Raw Blame History

Phase 02 — Remove unvalidated client fetch from curl/wget (audit M-2)

Story: n/a Context: .agents/PLAN.md §2 (principle 5 — fun is safe) & §3 (terminal modules), .agents/remediation_plan.md finding M-2

Objective

The fake terminal's curl/wget commands run a real, unvalidated fetch(url) from the visitor's browser — a client-side request-forgery primitive (and cookie-attached once the site ever has auth) that is also silently broken in production (CSP connect-src falls back to default-src 'self', blocking every external fetch). Replace the real fetch with simulated output consistent with the rest of the fake terminal: zero network I/O, deterministic, echoes the requested URL.

Chosen approach (audit recommendation, owner-approved 2026-09-18): simulate. The rejected alternative (real fetch + https-only allowlist + connect-src + credentials: 'omit') is documented for the record but out of scope.

Dependencies

— (none)

Tasks

01_simulate_fetch_output.md — Add simulatedCurlOutput(url) / simulatedWgetOutput(url) to terminal-commands.js; replace both fetch() calls in terminal.js with the simulated outputs.
02_fetch_regression_test.md — Add Playwright tests proving curl/wget render simulated output, make zero non-origin network requests, and still unlock the web_navigator achievement.

Testing & Quality

Unit/integration: the regression tests must cover (a) curl <url> renders the simulated block and echoes the URL, (b) wget <url> same, (c) no request to any non-origin host occurs (request listener), (d) web_navigator achievement/toast still fires.
Coverage: >90% on new/modified code (the two simulator functions + both branches).
E2E: full Playwright suite green.

Completion Criteria

grep -n "fetch(" src/terminal.js returns no matches (the only fetch( in src/ must be gone)
simulatedCurlOutput / simulatedWgetOutput present in src/terminal-commands.js
new regression tests present in tests/e2e/ and passing
./build.sh && npm test fully green (46+ tests)
no behavior change in completed work (terminal, vim, achievements, menu)

2.2 KiB Raw Blame History