fix(diplomacy): purify stored letter HTML

2026-07-31 15:52:43 +00:00
parent aaab3f1a91
commit eb9c1fe1e7
7 changed files with 679 additions and 4 deletions
@@ -0,0 +1,222 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import {
+    createGamePostgresConnector,
+    createRedisConnector,
+    resolveRedisConfigFromEnv,
+    type GamePrismaClient,
+    type RedisConnector,
+} from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { createGameApiServer } from '../src/server.js';
+
+const databaseUrl = process.env.INPUT_EVENT_DATABASE_URL;
+const integration = describe.skipIf(!databaseUrl || !process.env.REDIS_URL);
+const profileId = process.env.POSTGRES_SCHEMA ?? 'public';
+const profileName = `che:diplomacy-html-${process.pid}`;
+const userId = `diplomacy-html-user-${process.pid}`;
+const fixtureId = 920_000 + (process.pid % 50_000);
+const foreignNationId = fixtureId + 1;
+const secret = 'diplomacy-html-http-secret';
+const redisPrefix = `sammo:diplomacy-html:${process.pid}`;
+const envKeys = [
+    'PROFILE',
+    'SCENARIO',
+    'GAME_PROFILE_NAME',
+    'GAME_API_HOST',
+    'GAME_API_PORT',
+    'GAME_TOKEN_SECRET',
+    'GATEWAY_REDIS_PREFIX',
+    'GAME_UPLOAD_DIR',
+    'DATABASE_URL',
+] as const;
+const originalEnv = new Map(envKeys.map((key) => [key, process.env[key]]));
+
+type RunningServer = Awaited<ReturnType<typeof createGameApiServer>>;
+
+let server: RunningServer | null = null;
+let baseUrl = '';
+let uploadDir = '';
+let db: GamePrismaClient;
+let disconnectDb: (() => Promise<void>) | null = null;
+let redis: RedisConnector | null = null;
+let accessToken = '';
+let legacyLetterId = 0;
+
+const restoreEnv = (): void => {
+    for (const [key, value] of originalEnv) {
+        if (value === undefined) {
+            delete process.env[key];
+        } else {
+            process.env[key] = value;
+        }
+    }
+};
+
+const deleteProfileRedisKeys = async (): Promise<void> => {
+    if (!redis) return;
+    for await (const keys of redis.client.scanIterator({ MATCH: `sammo:game:*:${profileName}:*`, COUNT: 100 })) {
+        if (keys.length > 0) await redis.client.del(keys);
+    }
+};
+
+const cleanup = async (): Promise<void> => {
+    await db.diplomacyLetter.deleteMany({
+        where: {
+            OR: [
+                { srcNationId: fixtureId },
+                { destNationId: fixtureId },
+                { srcNationId: foreignNationId },
+                { destNationId: foreignNationId },
+            ],
+        },
+    });
+    await db.generalAccessLog.deleteMany({ where: { generalId: fixtureId } });
+    await db.general.deleteMany({ where: { id: fixtureId } });
+    await db.nation.deleteMany({ where: { id: { in: [fixtureId, foreignNationId] } } });
+    await db.worldState.deleteMany({ where: { scenarioCode: 'diplomacy-html' } });
+};
+
+integration('diplomacy HTML purification over PostgreSQL and HTTP transport', () => {
+    beforeAll(async () => {
+        uploadDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-diplomacy-html-http-'));
+        process.env.PROFILE = profileId;
+        process.env.SCENARIO = 'diplomacy-html';
+        process.env.GAME_PROFILE_NAME = profileName;
+        process.env.GAME_API_HOST = '127.0.0.1';
+        process.env.GAME_API_PORT = '0';
+        process.env.GAME_TOKEN_SECRET = secret;
+        process.env.GATEWAY_REDIS_PREFIX = redisPrefix;
+        process.env.GAME_UPLOAD_DIR = uploadDir;
+        process.env.DATABASE_URL = databaseUrl;
+
+        const connector = createGamePostgresConnector({ url: databaseUrl! });
+        await connector.connect();
+        db = connector.prisma;
+        disconnectDb = () => connector.disconnect();
+        await cleanup();
+
+        await db.worldState.create({
+            data: {
+                scenarioCode: 'diplomacy-html',
+                currentYear: 200,
+                currentMonth: 1,
+                tickSeconds: 600,
+                meta: {},
+            },
+        });
+        await db.nation.createMany({
+            data: [
+                { id: fixtureId, name: '정화국', color: '#00ffff' },
+                { id: foreignNationId, name: '상대국', color: '#ff0000' },
+            ],
+        });
+        await db.general.create({
+            data: {
+                id: fixtureId,
+                userId,
+                name: '정화외교관',
+                nationId: fixtureId,
+                officerLevel: 12,
+                turnTime: new Date('2026-07-31T00:00:00.000Z'),
+            },
+        });
+        const legacyLetter = await db.diplomacyLetter.create({
+            data: {
+                srcNationId: fixtureId,
+                destNationId: foreignNationId,
+                state: 'PROPOSED',
+                textBrief: '<p>과거 공개</p><img src=x onerror="globalThis.__legacyBriefXss=1">',
+                textDetail: '<strong>과거 기밀</strong><script>globalThis.__legacyDetailXss=1</script>',
+                srcSignerId: fixtureId,
+                aux: {
+                    src: { nationName: '정화국', nationColor: '#00ffff', generalId: fixtureId },
+                    dest: { nationName: '상대국', nationColor: '#ff0000' },
+                },
+            },
+        });
+        legacyLetterId = legacyLetter.id;
+
+        redis = createRedisConnector(resolveRedisConfigFromEnv());
+        await redis.connect();
+        const store = new RedisAccessTokenStore(redis.client, profileName);
+        const payload: GameSessionTokenPayload = {
+            version: 1,
+            profile: profileName,
+            issuedAt: new Date(Date.now() - 1_000).toISOString(),
+            expiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
+            sessionId: `diplomacy-html-session-${process.pid}`,
+            user: {
+                id: userId,
+                username: 'diplomacy-html-user',
+                displayName: 'Diplomacy HTML User',
+                roles: ['user'],
+                createdAt: '2026-07-31T00:00:00.000Z',
+            },
+            sanctions: {},
+        };
+        const created = await store.create(payload);
+        if (!created) throw new Error('failed to seed diplomacy HTML access token');
+        accessToken = created.accessToken;
+
+        server = await createGameApiServer();
+        baseUrl = await server.app.listen({ host: server.config.host, port: server.config.port });
+    }, 30_000);
+
+    afterAll(async () => {
+        await server?.app.close();
+        if (db) await cleanup();
+        await disconnectDb?.();
+        await deleteProfileRedisKeys();
+        await redis?.disconnect();
+        if (uploadDir) await fs.rm(uploadDir, { recursive: true, force: true });
+        restoreEnv();
+    }, 30_000);
+
+    it('purifies contaminated stored rows before HTTP serialization', async () => {
+        const response = await fetch(`${baseUrl}/trpc/diplomacy.getLetters`, {
+            headers: { authorization: `Bearer ${accessToken}` },
+        });
+        const body = (await response.json()) as {
+            result?: { data?: { letters?: Array<{ id: number; brief: string; detail: string }> } };
+        };
+
+        expect(response.status, JSON.stringify(body)).toBe(200);
+        expect(body.result?.data?.letters?.find(({ id }) => id === legacyLetterId)).toMatchObject({
+            brief: '<p>과거 공개</p><img src="x" />',
+            detail: '<strong>과거 기밀</strong>',
+        });
+        expect(JSON.stringify(body)).not.toMatch(/onerror|<script|__legacy/i);
+    });
+
+    it('persists only canonical editor HTML through the HTTP mutation', async () => {
+        const response = await fetch(`${baseUrl}/trpc/diplomacy.sendLetter`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${accessToken}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({
+                destNationId: foreignNationId,
+                brief: '<p><u>신규 공개</u></p><img src="javascript:alert(1)" onerror="alert(2)">',
+                detail: '<ol><li>조건</li></ol><a href="https://example.com" target="_blank">자료</a>',
+            }),
+        });
+        const body = (await response.json()) as { result?: { data?: { id?: number } } };
+
+        expect(response.status, JSON.stringify(body)).toBe(200);
+        const createdId = body.result?.data?.id;
+        expect(createdId).toBeTypeOf('number');
+        const stored = await db.diplomacyLetter.findUniqueOrThrow({ where: { id: createdId } });
+        expect(stored.textBrief).toBe('<p><u>신규 공개</u></p>');
+        expect(stored.textDetail).toBe(
+            '<ol><li>조건</li></ol><a href="https://example.com" target="_blank" rel="noopener noreferrer nofollow">자료</a>'
+        );
+    });
+});