mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-11 03:14:36 +00:00
perf(test): consolidate browser and canvas hotspot suites
This commit is contained in:
@@ -274,7 +274,7 @@ describe("browser control server", () => {
|
|||||||
await stopBrowserControlServer();
|
await stopBrowserControlServer();
|
||||||
});
|
});
|
||||||
|
|
||||||
it("serves status + starts browser when requested", async () => {
|
it("covers primary control routes, validation, and profile compatibility", async () => {
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
||||||
const started = await startBrowserControlServerFromConfig();
|
const started = await startBrowserControlServerFromConfig();
|
||||||
expect(started?.port).toBe(testPort);
|
expect(started?.port).toBe(testPort);
|
||||||
@@ -286,8 +286,28 @@ describe("browser control server", () => {
|
|||||||
};
|
};
|
||||||
expect(s1.running).toBe(false);
|
expect(s1.running).toBe(false);
|
||||||
expect(s1.pid).toBe(null);
|
expect(s1.pid).toBe(null);
|
||||||
|
expect(s1.profile).toBe("openclaw");
|
||||||
|
|
||||||
|
const tabsWhenStopped = (await realFetch(`${base}/tabs`).then((r) => r.json())) as {
|
||||||
|
running: boolean;
|
||||||
|
tabs: unknown[];
|
||||||
|
};
|
||||||
|
expect(tabsWhenStopped.running).toBe(false);
|
||||||
|
expect(Array.isArray(tabsWhenStopped.tabs)).toBe(true);
|
||||||
|
|
||||||
|
const focusStopped = await realFetch(`${base}/tabs/focus`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
body: JSON.stringify({ targetId: "abcd" }),
|
||||||
|
});
|
||||||
|
expect(focusStopped.status).toBe(409);
|
||||||
|
|
||||||
|
const startedPayload = (await realFetch(`${base}/start`, { method: "POST" }).then((r) =>
|
||||||
|
r.json(),
|
||||||
|
)) as { ok: boolean; profile?: string };
|
||||||
|
expect(startedPayload.ok).toBe(true);
|
||||||
|
expect(startedPayload.profile).toBe("openclaw");
|
||||||
|
|
||||||
await realFetch(`${base}/start`, { method: "POST" }).then((r) => r.json());
|
|
||||||
const s2 = (await realFetch(`${base}/`).then((r) => r.json())) as {
|
const s2 = (await realFetch(`${base}/`).then((r) => r.json())) as {
|
||||||
running: boolean;
|
running: boolean;
|
||||||
pid: number | null;
|
pid: number | null;
|
||||||
@@ -297,14 +317,7 @@ describe("browser control server", () => {
|
|||||||
expect(s2.pid).toBe(123);
|
expect(s2.pid).toBe(123);
|
||||||
expect(s2.chosenBrowser).toBe("chrome");
|
expect(s2.chosenBrowser).toBe("chrome");
|
||||||
expect(launchCalls.length).toBeGreaterThan(0);
|
expect(launchCalls.length).toBeGreaterThan(0);
|
||||||
});
|
|
||||||
|
|
||||||
it("handles tabs: list, open, focus conflict on ambiguous prefix", async () => {
|
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
|
||||||
await startBrowserControlServerFromConfig();
|
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
|
||||||
|
|
||||||
await realFetch(`${base}/start`, { method: "POST" }).then((r) => r.json());
|
|
||||||
const tabs = (await realFetch(`${base}/tabs`).then((r) => r.json())) as {
|
const tabs = (await realFetch(`${base}/tabs`).then((r) => r.json())) as {
|
||||||
running: boolean;
|
running: boolean;
|
||||||
tabs: Array<{ targetId: string }>;
|
tabs: Array<{ targetId: string }>;
|
||||||
@@ -312,45 +325,35 @@ describe("browser control server", () => {
|
|||||||
expect(tabs.running).toBe(true);
|
expect(tabs.running).toBe(true);
|
||||||
expect(tabs.tabs.length).toBeGreaterThan(0);
|
expect(tabs.tabs.length).toBeGreaterThan(0);
|
||||||
|
|
||||||
const opened = await realFetch(`${base}/tabs/open`, {
|
const openedDefault = (await realFetch(`${base}/tabs/open`, {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
headers: { "Content-Type": "application/json" },
|
headers: { "Content-Type": "application/json" },
|
||||||
body: JSON.stringify({ url: "https://example.com" }),
|
body: JSON.stringify({ url: "https://example.com" }),
|
||||||
}).then((r) => r.json());
|
}).then((r) => r.json())) as { targetId?: string };
|
||||||
expect(opened).toMatchObject({ targetId: "newtab1" });
|
expect(openedDefault.targetId).toBe("newtab1");
|
||||||
|
|
||||||
const focus = await realFetch(`${base}/tabs/focus`, {
|
createTargetId = "abcd1234";
|
||||||
|
const openedViaCdp = (await realFetch(`${base}/tabs/open`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
body: JSON.stringify({ url: "https://example.com" }),
|
||||||
|
}).then((r) => r.json())) as { targetId?: string };
|
||||||
|
expect(openedViaCdp.targetId).toBe("abcd1234");
|
||||||
|
createTargetId = null;
|
||||||
|
|
||||||
|
const focusAmbiguous = await realFetch(`${base}/tabs/focus`, {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
headers: { "Content-Type": "application/json" },
|
headers: { "Content-Type": "application/json" },
|
||||||
body: JSON.stringify({ targetId: "abc" }),
|
body: JSON.stringify({ targetId: "abc" }),
|
||||||
});
|
});
|
||||||
expect(focus.status).toBe(409);
|
expect(focusAmbiguous.status).toBe(409);
|
||||||
});
|
|
||||||
|
|
||||||
it("skips default maxChars when explicitly set to zero", async () => {
|
const focusMissing = await realFetch(`${base}/tabs/focus`, {
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
method: "POST",
|
||||||
await startBrowserControlServerFromConfig();
|
headers: { "Content-Type": "application/json" },
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
body: JSON.stringify({ targetId: "zzz" }),
|
||||||
await realFetch(`${base}/start`, { method: "POST" }).then((r) => r.json());
|
|
||||||
|
|
||||||
const snapAi = (await realFetch(`${base}/snapshot?format=ai&maxChars=0`).then((r) =>
|
|
||||||
r.json(),
|
|
||||||
)) as { ok: boolean; format?: string };
|
|
||||||
expect(snapAi.ok).toBe(true);
|
|
||||||
expect(snapAi.format).toBe("ai");
|
|
||||||
|
|
||||||
const [call] = pwMocks.snapshotAiViaPlaywright.mock.calls.at(-1) ?? [];
|
|
||||||
expect(call).toEqual({
|
|
||||||
cdpUrl: cdpBaseUrl,
|
|
||||||
targetId: "abcd1234",
|
|
||||||
});
|
});
|
||||||
});
|
expect(focusMissing.status).toBe(404);
|
||||||
|
|
||||||
it("validates agent inputs (agent routes)", async () => {
|
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
|
||||||
await startBrowserControlServerFromConfig();
|
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
|
||||||
await realFetch(`${base}/start`, { method: "POST" }).then((r) => r.json());
|
|
||||||
|
|
||||||
const navMissing = await realFetch(`${base}/navigate`, {
|
const navMissing = await realFetch(`${base}/navigate`, {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
@@ -429,112 +432,29 @@ describe("browser control server", () => {
|
|||||||
expect(snapDefault.ok).toBe(true);
|
expect(snapDefault.ok).toBe(true);
|
||||||
expect(snapDefault.format).toBe("ai");
|
expect(snapDefault.format).toBe("ai");
|
||||||
|
|
||||||
|
const snapAi = (await realFetch(`${base}/snapshot?format=ai&maxChars=0`).then((r) =>
|
||||||
|
r.json(),
|
||||||
|
)) as { ok: boolean; format?: string };
|
||||||
|
expect(snapAi.ok).toBe(true);
|
||||||
|
expect(snapAi.format).toBe("ai");
|
||||||
|
const [call] = pwMocks.snapshotAiViaPlaywright.mock.calls.at(-1) ?? [];
|
||||||
|
expect(call).toEqual({
|
||||||
|
cdpUrl: cdpBaseUrl,
|
||||||
|
targetId: "abcd1234",
|
||||||
|
});
|
||||||
|
|
||||||
|
const snapAmbiguous = await realFetch(`${base}/snapshot?format=aria&targetId=abc`);
|
||||||
|
expect(snapAmbiguous.status).toBe(409);
|
||||||
|
|
||||||
const screenshotBadCombo = await realFetch(`${base}/screenshot`, {
|
const screenshotBadCombo = await realFetch(`${base}/screenshot`, {
|
||||||
method: "POST",
|
method: "POST",
|
||||||
headers: { "Content-Type": "application/json" },
|
headers: { "Content-Type": "application/json" },
|
||||||
body: JSON.stringify({ fullPage: true, element: "body" }),
|
body: JSON.stringify({ fullPage: true, element: "body" }),
|
||||||
});
|
});
|
||||||
expect(screenshotBadCombo.status).toBe(400);
|
expect(screenshotBadCombo.status).toBe(400);
|
||||||
});
|
const delAmbiguous = await realFetch(`${base}/tabs/abc`, { method: "DELETE" });
|
||||||
|
|
||||||
it("covers common error branches", async () => {
|
|
||||||
cfgAttachOnly = true;
|
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
|
||||||
await startBrowserControlServerFromConfig();
|
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
|
||||||
|
|
||||||
const missing = await realFetch(`${base}/tabs/open`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({}),
|
|
||||||
});
|
|
||||||
expect(missing.status).toBe(400);
|
|
||||||
|
|
||||||
reachable = false;
|
|
||||||
const started = (await realFetch(`${base}/start`, {
|
|
||||||
method: "POST",
|
|
||||||
}).then((r) => r.json())) as { error?: string };
|
|
||||||
expect(started.error ?? "").toMatch(/attachOnly/i);
|
|
||||||
});
|
|
||||||
|
|
||||||
it("covers additional endpoint branches", async () => {
|
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
|
||||||
await startBrowserControlServerFromConfig();
|
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
|
||||||
|
|
||||||
const tabsWhenStopped = (await realFetch(`${base}/tabs`).then((r) => r.json())) as {
|
|
||||||
running: boolean;
|
|
||||||
tabs: unknown[];
|
|
||||||
};
|
|
||||||
expect(tabsWhenStopped.running).toBe(false);
|
|
||||||
expect(Array.isArray(tabsWhenStopped.tabs)).toBe(true);
|
|
||||||
|
|
||||||
const focusStopped = await realFetch(`${base}/tabs/focus`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({ targetId: "abcd" }),
|
|
||||||
});
|
|
||||||
expect(focusStopped.status).toBe(409);
|
|
||||||
|
|
||||||
await realFetch(`${base}/start`, { method: "POST" }).then((r) => r.json());
|
|
||||||
|
|
||||||
const focusMissing = await realFetch(`${base}/tabs/focus`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({ targetId: "zzz" }),
|
|
||||||
});
|
|
||||||
expect(focusMissing.status).toBe(404);
|
|
||||||
|
|
||||||
const delAmbiguous = await realFetch(`${base}/tabs/abc`, {
|
|
||||||
method: "DELETE",
|
|
||||||
});
|
|
||||||
expect(delAmbiguous.status).toBe(409);
|
expect(delAmbiguous.status).toBe(409);
|
||||||
|
|
||||||
const snapAmbiguous = await realFetch(`${base}/snapshot?format=aria&targetId=abc`);
|
|
||||||
expect(snapAmbiguous.status).toBe(409);
|
|
||||||
});
|
|
||||||
|
|
||||||
it("handles backward-compatible profile routes", async () => {
|
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
|
||||||
await startBrowserControlServerFromConfig();
|
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
|
||||||
|
|
||||||
const status = (await realFetch(`${base}/`).then((r) => r.json())) as {
|
|
||||||
running: boolean;
|
|
||||||
profile?: string;
|
|
||||||
};
|
|
||||||
expect(status.running).toBe(false);
|
|
||||||
expect(status.profile).toBe("openclaw");
|
|
||||||
|
|
||||||
const started = (await realFetch(`${base}/start`, { method: "POST" }).then((r) =>
|
|
||||||
r.json(),
|
|
||||||
)) as { ok: boolean; profile?: string };
|
|
||||||
expect(started.ok).toBe(true);
|
|
||||||
expect(started.profile).toBe("openclaw");
|
|
||||||
|
|
||||||
const stopped = (await realFetch(`${base}/stop`, { method: "POST" }).then((r) => r.json())) as {
|
|
||||||
ok: boolean;
|
|
||||||
profile?: string;
|
|
||||||
};
|
|
||||||
expect(stopped.ok).toBe(true);
|
|
||||||
expect(stopped.profile).toBe("openclaw");
|
|
||||||
|
|
||||||
await realFetch(`${base}/start`, { method: "POST" });
|
|
||||||
|
|
||||||
const tabsDefault = (await realFetch(`${base}/tabs`).then((r) => r.json())) as {
|
|
||||||
running: boolean;
|
|
||||||
tabs: unknown[];
|
|
||||||
};
|
|
||||||
expect(tabsDefault.running).toBe(true);
|
|
||||||
expect(Array.isArray(tabsDefault.tabs)).toBe(true);
|
|
||||||
|
|
||||||
const openDefault = (await realFetch(`${base}/tabs/open`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({ url: "https://example.com" }),
|
|
||||||
}).then((r) => r.json())) as { targetId?: string };
|
|
||||||
expect(openDefault.targetId).toBe("newtab1");
|
|
||||||
|
|
||||||
const profiles = (await realFetch(`${base}/profiles`).then((r) => r.json())) as {
|
const profiles = (await realFetch(`${base}/profiles`).then((r) => r.json())) as {
|
||||||
profiles: Array<{ name: string }>;
|
profiles: Array<{ name: string }>;
|
||||||
};
|
};
|
||||||
@@ -560,6 +480,33 @@ describe("browser control server", () => {
|
|||||||
expect(unknownProfile.status).toBe(404);
|
expect(unknownProfile.status).toBe(404);
|
||||||
const unknownPayload = (await unknownProfile.json()) as { error: string };
|
const unknownPayload = (await unknownProfile.json()) as { error: string };
|
||||||
expect(unknownPayload.error).toContain("not found");
|
expect(unknownPayload.error).toContain("not found");
|
||||||
|
|
||||||
|
const stopped = (await realFetch(`${base}/stop`, { method: "POST" }).then((r) => r.json())) as {
|
||||||
|
ok: boolean;
|
||||||
|
profile?: string;
|
||||||
|
};
|
||||||
|
expect(stopped.ok).toBe(true);
|
||||||
|
expect(stopped.profile).toBe("openclaw");
|
||||||
|
});
|
||||||
|
|
||||||
|
it("covers common error branches", async () => {
|
||||||
|
cfgAttachOnly = true;
|
||||||
|
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
||||||
|
await startBrowserControlServerFromConfig();
|
||||||
|
const base = `http://127.0.0.1:${testPort}`;
|
||||||
|
|
||||||
|
const missing = await realFetch(`${base}/tabs/open`, {
|
||||||
|
method: "POST",
|
||||||
|
headers: { "Content-Type": "application/json" },
|
||||||
|
body: JSON.stringify({}),
|
||||||
|
});
|
||||||
|
expect(missing.status).toBe(400);
|
||||||
|
|
||||||
|
reachable = false;
|
||||||
|
const started = (await realFetch(`${base}/start`, {
|
||||||
|
method: "POST",
|
||||||
|
}).then((r) => r.json())) as { error?: string };
|
||||||
|
expect(started.error ?? "").toMatch(/attachOnly/i);
|
||||||
});
|
});
|
||||||
|
|
||||||
it("allows attachOnly servers to ensure reachability via callback", async () => {
|
it("allows attachOnly servers to ensure reachability via callback", async () => {
|
||||||
@@ -603,19 +550,4 @@ describe("browser control server", () => {
|
|||||||
|
|
||||||
await new Promise<void>((resolve) => bridge.server.close(() => resolve()));
|
await new Promise<void>((resolve) => bridge.server.close(() => resolve()));
|
||||||
});
|
});
|
||||||
|
|
||||||
it("opens tabs via CDP createTarget path", async () => {
|
|
||||||
const { startBrowserControlServerFromConfig } = await import("./server.js");
|
|
||||||
await startBrowserControlServerFromConfig();
|
|
||||||
const base = `http://127.0.0.1:${testPort}`;
|
|
||||||
await realFetch(`${base}/start`, { method: "POST" }).then((r) => r.json());
|
|
||||||
|
|
||||||
createTargetId = "abcd1234";
|
|
||||||
const opened = (await realFetch(`${base}/tabs/open`, {
|
|
||||||
method: "POST",
|
|
||||||
headers: { "Content-Type": "application/json" },
|
|
||||||
body: JSON.stringify({ url: "https://example.com" }),
|
|
||||||
}).then((r) => r.json())) as { targetId?: string };
|
|
||||||
expect(opened.targetId).toBe("abcd1234");
|
|
||||||
});
|
|
||||||
});
|
});
|
||||||
|
|||||||
@@ -11,6 +11,10 @@ import { A2UI_PATH, CANVAS_HOST_PATH, CANVAS_WS_PATH, injectCanvasLiveReload } f
|
|||||||
import { createCanvasHostHandler, startCanvasHost } from "./server.js";
|
import { createCanvasHostHandler, startCanvasHost } from "./server.js";
|
||||||
|
|
||||||
describe("canvas host", () => {
|
describe("canvas host", () => {
|
||||||
|
const quietRuntime = {
|
||||||
|
...defaultRuntime,
|
||||||
|
log: (..._args: Parameters<typeof console.log>) => {},
|
||||||
|
};
|
||||||
let fixtureRoot = "";
|
let fixtureRoot = "";
|
||||||
let fixtureCount = 0;
|
let fixtureCount = 0;
|
||||||
|
|
||||||
@@ -40,7 +44,7 @@ describe("canvas host", () => {
|
|||||||
const dir = await createCaseDir();
|
const dir = await createCaseDir();
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
const server = await startCanvasHost({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
rootDir: dir,
|
rootDir: dir,
|
||||||
port: 0,
|
port: 0,
|
||||||
listenHost: "127.0.0.1",
|
listenHost: "127.0.0.1",
|
||||||
@@ -64,7 +68,7 @@ describe("canvas host", () => {
|
|||||||
await fs.writeFile(path.join(dir, "index.html"), "<html><body>no-reload</body></html>", "utf8");
|
await fs.writeFile(path.join(dir, "index.html"), "<html><body>no-reload</body></html>", "utf8");
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
const server = await startCanvasHost({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
rootDir: dir,
|
rootDir: dir,
|
||||||
port: 0,
|
port: 0,
|
||||||
listenHost: "127.0.0.1",
|
listenHost: "127.0.0.1",
|
||||||
@@ -91,7 +95,7 @@ describe("canvas host", () => {
|
|||||||
await fs.writeFile(path.join(dir, "index.html"), "<html><body>v1</body></html>", "utf8");
|
await fs.writeFile(path.join(dir, "index.html"), "<html><body>v1</body></html>", "utf8");
|
||||||
|
|
||||||
const handler = await createCanvasHostHandler({
|
const handler = await createCanvasHostHandler({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
rootDir: dir,
|
rootDir: dir,
|
||||||
basePath: CANVAS_HOST_PATH,
|
basePath: CANVAS_HOST_PATH,
|
||||||
allowInTests: true,
|
allowInTests: true,
|
||||||
@@ -139,7 +143,7 @@ describe("canvas host", () => {
|
|||||||
await fs.writeFile(path.join(dir, "index.html"), "<html><body>v1</body></html>", "utf8");
|
await fs.writeFile(path.join(dir, "index.html"), "<html><body>v1</body></html>", "utf8");
|
||||||
|
|
||||||
const handler = await createCanvasHostHandler({
|
const handler = await createCanvasHostHandler({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
rootDir: dir,
|
rootDir: dir,
|
||||||
basePath: CANVAS_HOST_PATH,
|
basePath: CANVAS_HOST_PATH,
|
||||||
allowInTests: true,
|
allowInTests: true,
|
||||||
@@ -149,7 +153,7 @@ describe("canvas host", () => {
|
|||||||
handler.close = closeSpy;
|
handler.close = closeSpy;
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
const server = await startCanvasHost({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
handler,
|
handler,
|
||||||
ownsHandler: false,
|
ownsHandler: false,
|
||||||
port: 0,
|
port: 0,
|
||||||
@@ -172,7 +176,7 @@ describe("canvas host", () => {
|
|||||||
await fs.writeFile(index, "<html><body>v1</body></html>", "utf8");
|
await fs.writeFile(index, "<html><body>v1</body></html>", "utf8");
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
const server = await startCanvasHost({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
rootDir: dir,
|
rootDir: dir,
|
||||||
port: 0,
|
port: 0,
|
||||||
listenHost: "127.0.0.1",
|
listenHost: "127.0.0.1",
|
||||||
@@ -215,82 +219,7 @@ describe("canvas host", () => {
|
|||||||
}
|
}
|
||||||
}, 20_000);
|
}, 20_000);
|
||||||
|
|
||||||
it("serves the gateway-hosted A2UI scaffold", async () => {
|
it("serves A2UI scaffold and blocks traversal/symlink escapes", async () => {
|
||||||
const dir = await createCaseDir();
|
|
||||||
const a2uiRoot = path.resolve(process.cwd(), "src/canvas-host/a2ui");
|
|
||||||
const bundlePath = path.join(a2uiRoot, "a2ui.bundle.js");
|
|
||||||
let createdBundle = false;
|
|
||||||
|
|
||||||
try {
|
|
||||||
await fs.stat(bundlePath);
|
|
||||||
} catch {
|
|
||||||
await fs.writeFile(bundlePath, "window.openclawA2UI = {};", "utf8");
|
|
||||||
createdBundle = true;
|
|
||||||
}
|
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
|
||||||
runtime: defaultRuntime,
|
|
||||||
rootDir: dir,
|
|
||||||
port: 0,
|
|
||||||
listenHost: "127.0.0.1",
|
|
||||||
allowInTests: true,
|
|
||||||
});
|
|
||||||
|
|
||||||
try {
|
|
||||||
const res = await fetch(`http://127.0.0.1:${server.port}/__openclaw__/a2ui/`);
|
|
||||||
const html = await res.text();
|
|
||||||
expect(res.status).toBe(200);
|
|
||||||
expect(html).toContain("openclaw-a2ui-host");
|
|
||||||
expect(html).toContain("openclawCanvasA2UIAction");
|
|
||||||
|
|
||||||
const bundleRes = await fetch(
|
|
||||||
`http://127.0.0.1:${server.port}/__openclaw__/a2ui/a2ui.bundle.js`,
|
|
||||||
);
|
|
||||||
const js = await bundleRes.text();
|
|
||||||
expect(bundleRes.status).toBe(200);
|
|
||||||
expect(js).toContain("openclawA2UI");
|
|
||||||
} finally {
|
|
||||||
await server.close();
|
|
||||||
if (createdBundle) {
|
|
||||||
await fs.rm(bundlePath, { force: true });
|
|
||||||
}
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
it("rejects traversal-style A2UI asset requests", async () => {
|
|
||||||
const dir = await createCaseDir();
|
|
||||||
const a2uiRoot = path.resolve(process.cwd(), "src/canvas-host/a2ui");
|
|
||||||
const bundlePath = path.join(a2uiRoot, "a2ui.bundle.js");
|
|
||||||
let createdBundle = false;
|
|
||||||
|
|
||||||
try {
|
|
||||||
await fs.stat(bundlePath);
|
|
||||||
} catch {
|
|
||||||
await fs.writeFile(bundlePath, "window.openclawA2UI = {};", "utf8");
|
|
||||||
createdBundle = true;
|
|
||||||
}
|
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
|
||||||
runtime: defaultRuntime,
|
|
||||||
rootDir: dir,
|
|
||||||
port: 0,
|
|
||||||
listenHost: "127.0.0.1",
|
|
||||||
allowInTests: true,
|
|
||||||
});
|
|
||||||
|
|
||||||
try {
|
|
||||||
const res = await fetch(`http://127.0.0.1:${server.port}${A2UI_PATH}/%2e%2e%2fpackage.json`);
|
|
||||||
expect(res.status).toBe(404);
|
|
||||||
expect(await res.text()).toBe("not found");
|
|
||||||
} finally {
|
|
||||||
await server.close();
|
|
||||||
if (createdBundle) {
|
|
||||||
await fs.rm(bundlePath, { force: true });
|
|
||||||
}
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
it("rejects A2UI symlink escapes", async () => {
|
|
||||||
const dir = await createCaseDir();
|
const dir = await createCaseDir();
|
||||||
const a2uiRoot = path.resolve(process.cwd(), "src/canvas-host/a2ui");
|
const a2uiRoot = path.resolve(process.cwd(), "src/canvas-host/a2ui");
|
||||||
const bundlePath = path.join(a2uiRoot, "a2ui.bundle.js");
|
const bundlePath = path.join(a2uiRoot, "a2ui.bundle.js");
|
||||||
@@ -310,7 +239,7 @@ describe("canvas host", () => {
|
|||||||
createdLink = true;
|
createdLink = true;
|
||||||
|
|
||||||
const server = await startCanvasHost({
|
const server = await startCanvasHost({
|
||||||
runtime: defaultRuntime,
|
runtime: quietRuntime,
|
||||||
rootDir: dir,
|
rootDir: dir,
|
||||||
port: 0,
|
port: 0,
|
||||||
listenHost: "127.0.0.1",
|
listenHost: "127.0.0.1",
|
||||||
@@ -318,9 +247,26 @@ describe("canvas host", () => {
|
|||||||
});
|
});
|
||||||
|
|
||||||
try {
|
try {
|
||||||
const res = await fetch(`http://127.0.0.1:${server.port}${A2UI_PATH}/${linkName}`);
|
const res = await fetch(`http://127.0.0.1:${server.port}/__openclaw__/a2ui/`);
|
||||||
expect(res.status).toBe(404);
|
const html = await res.text();
|
||||||
expect(await res.text()).toBe("not found");
|
expect(res.status).toBe(200);
|
||||||
|
expect(html).toContain("openclaw-a2ui-host");
|
||||||
|
expect(html).toContain("openclawCanvasA2UIAction");
|
||||||
|
|
||||||
|
const bundleRes = await fetch(
|
||||||
|
`http://127.0.0.1:${server.port}/__openclaw__/a2ui/a2ui.bundle.js`,
|
||||||
|
);
|
||||||
|
const js = await bundleRes.text();
|
||||||
|
expect(bundleRes.status).toBe(200);
|
||||||
|
expect(js).toContain("openclawA2UI");
|
||||||
|
const traversalRes = await fetch(
|
||||||
|
`http://127.0.0.1:${server.port}${A2UI_PATH}/%2e%2e%2fpackage.json`,
|
||||||
|
);
|
||||||
|
expect(traversalRes.status).toBe(404);
|
||||||
|
expect(await traversalRes.text()).toBe("not found");
|
||||||
|
const symlinkRes = await fetch(`http://127.0.0.1:${server.port}${A2UI_PATH}/${linkName}`);
|
||||||
|
expect(symlinkRes.status).toBe(404);
|
||||||
|
expect(await symlinkRes.text()).toBe("not found");
|
||||||
} finally {
|
} finally {
|
||||||
await server.close();
|
await server.close();
|
||||||
if (createdLink) {
|
if (createdLink) {
|
||||||
|
|||||||
Reference in New Issue
Block a user