Checkpoint web parity through Chromium input tasks

web/tests/e2e/malicious-script.spec.ts

@@ -0,0 +1,22 @@
+import fs from "node:fs";
+import path from "node:path";
+import { expect, test } from "@playwright/test";
+
+const root = path.resolve(import.meta.dirname, "../../..");
+const fixture = Array.from(fs.readFileSync(path.join(root, "tests/files/web/m13_malicious_script_v1/malicious-script.blend")));
+
+test("M13-01F blocks malicious Text, driver, handler and embedded module sources", async ({ page }) => {
+  await page.goto("/");
+  const result = await page.evaluate(async (bytes) => {
+    const { WebEngineClient } = await import("/src/engine-client/WebEngineClient.ts");
+    const client = new WebEngineClient({ timeoutMs: 30_000 });
+    const opened = await client.openBlend(Uint8Array.from(bytes).buffer);
+    const sources = opened.snapshot.scriptSources;
+    client.terminate();
+    return sources;
+  }, fixture);
+  expect(result?.sources).toHaveLength(4);
+  expect(result?.sources.every((source: any) => source.readOnly && source.executionStatus === "BLOCKED" && /^[a-f0-9]{64}$/.test(source.sourceSha256))).toBe(true);
+  expect(result?.sources.find((source: any) => source.name === "EmbeddedModule.py")).toMatchObject({ moduleAutorunRequested: true, errorCode: "SCRIPT_POLICY_DENIED" });
+  expect(result?.sources.map((source: any) => source.name).sort()).toEqual(["DriverExploit.py", "EmbeddedModule.py", "HandlerExploit.py", "MaliciousText.py"]);
+});