Repository navigation
test: assert every SVG active-content allowlist entry is accepted - #1765
Conversation
scripts/lib/svg-active-content.mjs decides which elements and attributes an uploaded SVG may contain, and its policy is nine exported allowlists. Almost none of their entries was exercised by name. Line coverage cannot see this: the module is at 100.00% lines and 100.00% regions, because a handful of SVGs walk every branch of findActiveContent without naming most of the tables those branches consult. Set membership is data, not a branch, so a wrong entry costs no coverage. The mutation gate measures it directly -- 195 of the module's 956 mutants survived, the largest surviving population in the tree, and 104 of those were single allowlist entries that could each be blanked with the whole suite still green. Generate one named assertion per entry, from the sets rather than copied out of them, so an entry added later is covered as soon as it is added and a deleted entry fails by its own name. SVG_ROOT_ATTRIBUTES is asserted on both sides -- accepted on <svg>, still a finding below it -- because the root restriction is the entry's whole purpose. The CSS url-string functions are included for the opposite reason: an unrecognized entry there fails open, letting a javascript: payload through, so each is asserted to still be read as a URL. No production code changes. Signed-off-by: hivecommons-hive[bot] <223556219+Copilot@users.noreply.github.com> Signed-off-by: quality <280983584+hivecommons-hive[bot]@users.noreply.github.com>
|
Important Held for human review by the hive's ACMM level gate. This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an Hive will keep the |
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Read the module and ran the branch: this looks correct to me.
Verified against the tree at 2e6478f:
- All nine imported allowlists are real exports of
scripts/lib/svg-active-content.mjs(lines 54–323), and the generated tests consume them by iteration, so future entries are covered automatically. - The expected finding strings match the code exactly:
contains ${attribute.finding}atscripts/lib/svg-active-content.mjs:958witha disallowed attribute ${name} on <${event.name}>at line 893 produces theSVG_ROOT_ATTRIBUTESrejection message asserted in the test; the<style>scheme message matches line 962. - The seven CSS functions asserted fail-closed are exactly the module's
URL_STRING_FUNCTIONS(lines 371–379). Note that set is not exported, so this one list is copied rather than generated — a new entry added there later won't auto-gain a test. Fine as-is; just a thing to remember if that set grows. - Ran
node --test tests/svg-active-content.test.mjson the PR head: 365 pass, 0 fail.
Test-only change, no production code touched, file set is disjoint from #1761 and #1763 as the body claims. The only outstanding check is the in-progress e2e coverage run, which this diff cannot affect. A maintainer could merge this as-is; I have not approved or merged anything.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
Keep supported-name assertions when a policy entry is deleted, and verify each of the nine exported allowlists counterfactually without changing production policy. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
|
Maintainer-delegated P2 merge disposition: reviewed repaired exact head 9d2e5c5. The independent acceptance fixtures detect all 236 isolated supported-entry deletions, including circle; focused, full-coverage, lint and build gates pass, and fresh-head CI is green. The maintainer explicitly approved this repair and protected merge. Agent inspection is not independent human approval. The body now says Refs1764, but GitHub still exposes its old closing association; issue1764 must remain open for the unrelated folded MDX finding, and any automatic closure will be corrected after merge. No production SVG policy, ADR or protection change. |
🔒 Hold-gate integrity: branch changed while hold-gated — fresh review requiredThis PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was Commits not present in the hold-time snapshot (1):
Authors not in the hold-time author set: A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes. |
Summary
Exercise supported SVG, XHTML, XLink, XML and editor-metadata names with
fixtures that do not import or enumerate the production policy Sets.
Deleting a supported policy name must fail an acceptance case, not delete
the case itself.
namespace/context rules, including root-only attribute rejection elsewhere.
need deliberate corresponding fixture updates.
Evidence
All 365 focused cases pass. A session-only preload then deletes exactly one
entry from exactly one of the nine exported Sets before running the actual
acceptance tests in a fresh process. Every one of 236 isolated deletions
produces an assertion failure, including
SVG_ELEMENTSentrycircle:zero missed deletions. The probe mutates memory only; no production file or
test switch is added to the repository.
The full required unit coverage gate, all six lint gates and production build
pass. This is a counterfactual deletion result, not a claimed new full-module
Stryker score.
Tracker scope
Refs #1764. That issue received an unrelated folded MDX grammar
finding after the original SVG PR was opened. This PR addresses only the
SVG acceptance finding; the folded MDX item is outside this approved repair
and must not be silently closed by this merge.
Maintainer authorization
The maintainer explicitly approved independent SVG fixtures, correction of
the deletion-protection claim, and this designated P2 hold release and
exact-head protected merge after required checks pass. Agent inspection is
not independent human approval. No protection bypass or new ADR exception.