fix(diplomacy): purify stored letter HTML

2026-07-31 15:52:43 +00:00
parent aaab3f1a91
commit eb9c1fe1e7
7 changed files with 679 additions and 4 deletions
@@ -0,0 +1,173 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
+import { InMemoryBattleSimTransport } from '../src/battleSim/inMemoryTransport.js';
+import { InMemoryTurnDaemonTransport } from '../src/daemon/inMemoryTransport.js';
+import { appRouter } from '../src/router.js';
+
+const auth: GameSessionTokenPayload = {
+    version: 1,
+    profile: 'che:default',
+    issuedAt: '2026-07-31T00:00:00.000Z',
+    expiresAt: '2026-08-01T00:00:00.000Z',
+    sessionId: 'diplomacy-html-session',
+    user: {
+        id: 'diplomacy-user',
+        username: 'diplomacy-user',
+        displayName: '외교 사용자',
+        roles: [],
+    },
+    sanctions: {},
+};
+
+const buildGeneral = (officerLevel: number): GeneralRow => ({
+    id: 1,
+    userId: auth.user.id,
+    name: '외교담당',
+    nationId: 1,
+    cityId: 1,
+    troopId: 0,
+    npcState: 0,
+    affinity: null,
+    bornYear: 180,
+    deadYear: 300,
+    picture: null,
+    imageServer: 0,
+    leadership: 50,
+    strength: 50,
+    intel: 50,
+    injury: 0,
+    experience: 0,
+    dedication: 0,
+    officerLevel,
+    gold: 1_000,
+    rice: 1_000,
+    crew: 0,
+    crewTypeId: 0,
+    train: 0,
+    atmos: 0,
+    weaponCode: 'None',
+    bookCode: 'None',
+    horseCode: 'None',
+    itemCode: 'None',
+    turnTime: new Date('2026-07-31T00:00:00.000Z'),
+    recentWarTime: null,
+    age: 20,
+    startAge: 20,
+    personalCode: 'None',
+    specialCode: 'None',
+    special2Code: 'None',
+    lastTurn: {},
+    meta: {},
+    penalty: {},
+    createdAt: new Date('2026-07-31T00:00:00.000Z'),
+    updatedAt: new Date('2026-07-31T00:00:00.000Z'),
+});
+
+const storedLetter = {
+    id: 7,
+    srcNationId: 1,
+    destNationId: 2,
+    prevId: null,
+    state: 'PROPOSED',
+    textBrief: '<p>공개</p><img src=x onerror="globalThis.__briefXss=1"><script>alert(1)</script>',
+    textDetail: '<strong>기밀</strong><a href="javascript:alert(2)" onclick="alert(3)">링크</a>',
+    date: new Date('2026-07-31T00:00:00.000Z'),
+    aux: {
+        src: { nationName: '위', nationColor: '#0000ff', generalId: 1, generalName: '외교담당' },
+        dest: { nationName: '촉', nationColor: '#ff0000' },
+    },
+};
+
+const buildContext = (officerLevel = 12) => {
+    const create = vi.fn(async () => ({ id: 9 }));
+    const db = {
+        general: {
+            findFirst: vi.fn(async () => buildGeneral(officerLevel)),
+        },
+        nation: {
+            findUnique: vi.fn(async () => ({ meta: {} })),
+            findMany: vi.fn(async ({ where }: { where: { id?: { in?: number[]; not?: number } } }) => {
+                if (where.id?.in) {
+                    return [
+                        { id: 1, name: '위', color: '#0000ff' },
+                        { id: 2, name: '촉', color: '#ff0000' },
+                    ];
+                }
+                return [{ id: 2, name: '촉', color: '#ff0000', level: 5 }];
+            }),
+        },
+        diplomacyLetter: {
+            findMany: vi.fn(async () => [storedLetter]),
+            findFirst: vi.fn(async () => null),
+            create,
+        },
+    };
+    const redis = {
+        get: async () => null,
+        set: async () => null,
+    } as unknown as RedisConnector['client'];
+    const context: GameApiContext = {
+        db: db as unknown as DatabaseClient,
+        turnDaemon: new InMemoryTurnDaemonTransport(),
+        battleSim: new InMemoryBattleSimTransport(),
+        profile: { id: 'che', scenario: 'default', name: 'che:default' },
+        auth,
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        redis,
+        accessTokenStore: new RedisAccessTokenStore(redis, 'che:default'),
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'test-secret',
+    };
+    return { caller: appRouter.createCaller(context), create };
+};
+
+describe('diplomacy HTML API boundary', () => {
+    it('purifies editor HTML before persistence', async () => {
+        const fixture = buildContext();
+        await expect(
+            fixture.caller.diplomacy.sendLetter({
+                destNationId: 2,
+                brief: '<p><strong>공개</strong></p><img src="javascript:alert(1)" onerror="alert(2)">',
+                detail: '<ul><li>조건</li></ul><a href="https://example.com" target="_blank">자료</a>',
+            })
+        ).resolves.toEqual({ id: 9 });
+
+        expect(fixture.create).toHaveBeenCalledWith({
+            data: expect.objectContaining({
+                textBrief: '<p><strong>공개</strong></p>',
+                textDetail:
+                    '<ul><li>조건</li></ul><a href="https://example.com" target="_blank" rel="noopener noreferrer nofollow">자료</a>',
+            }),
+        });
+    });
+
+    it('purifies legacy stored rows on every read while preserving secret redaction', async () => {
+        const visible = await buildContext(12).caller.diplomacy.getLetters();
+        expect(visible.letters[0]).toMatchObject({
+            brief: '<p>공개</p><img src="x" />',
+            detail: '<strong>기밀</strong><a>링크</a>',
+        });
+        expect(JSON.stringify(visible)).not.toMatch(/onerror|onclick|javascript:|<script/i);
+
+        const redacted = await buildContext(5).caller.diplomacy.getLetters();
+        expect(redacted.permission).toBe(2);
+        expect(redacted.letters[0]?.brief).toBe('<p>공개</p><img src="x" />');
+        expect(redacted.letters[0]?.detail).toBe('(권한이 부족합니다)');
+    });
+
+    it('rejects direct send mutations below the Ref diplomacy permission without writing', async () => {
+        const fixture = buildContext(5);
+        await expect(
+            fixture.caller.diplomacy.sendLetter({ destNationId: 2, brief: '<p>공개</p>', detail: '<p>기밀</p>' })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        expect(fixture.create).not.toHaveBeenCalled();
+    });
+});