Checkpoint web parity through Chromium input tasks

web/tests/e2e/archive-security-fixtures.spec.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "@playwright/test";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+const root = path.resolve(import.meta.dirname, "../../..");
+
+test("N-023 asset malicious ZIP/TAR fixtures remain in the archive security regression", async () => {
+  const output = execFileSync(process.execPath, [path.join(root, "tools/web/check-malicious-archive-fixtures.mjs")], {
+    cwd: root,
+    encoding: "utf8",
+  });
+  expect(output).toContain("malicious-archive-fixtures-ok cases=6 zip=3 tar=3 extraction=disabled");
+
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, "tests/files/web/archive-security/manifest.json"), "utf8"));
+  expect(manifest.extractionAllowed).toBe(false);
+  expect(manifest.cases).toHaveLength(6);
+  expect(manifest.cases.map((fixture: { expectedCode: string }) => fixture.expectedCode)).toEqual(
+    Array.from({ length: 6 }, () => "IO_ARCHIVE_UNSAFE"),
+  );
+});