k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-22 06:56:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(client,sdk): the smaller silent failures, and a dead SDK test file

Browse Source 
The SDK's parity suite had an unescaped apostrophe in an it() title, so the
file did not parse and vitest reported it as "no tests". Both guards in it
were dead - including the byte-identical egress-policy check the package's own
notes call the worst possible bug in that module to lose. No CI job runs the
SDK suite, so it landed quietly; the next npm publish would have failed on it,
since prepublishOnly runs the tests.

Also in the SDK: the dev preview answered trek:geolocation without checking
the geolocation:read grant, so a plugin whose manifest is missing the
permission works perfectly in dev and is dead once installed. That is the
lenient direction, which is the one that ships broken plugins.

Client side: the background-task poll never dismissed a 404'd import job and
spun forever, "Update All" collapsed its busy flag after the first plugin
settled, the lightbox had no cancellation so a slow signed URL rendered the
wrong image, the plugin geolocation watch was torn down by any unrelated
settings write, manual date entry accepted 31 February, cover previews were
never revoked, and check-all issued one request per packing item.
This commit is contained in:
Maurice
2026-08-23 10:08:38 +02:00
committed by Maurice
parent b3d8bf08f1
commit c75e958fc0
27 changed files with 476 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/components/PDF/TripPDF.test.ts
+12
View File
@@ -300,6 +300,18 @@ describe('downloadTripPDF', () => {
expect(iframe!.srcdoc).toContain('cover.jpg')
})
it('FE-COMP-TRIPPDF-023: a cover url cannot close url() and add a second declaration', async () => {
// cover_image is a free string on the write path, and the style attribute is decoded
// before the CSS is parsed, so the quote and the paren have to be encoded.
const hostile = "http://host/a.jpg');background-image:url('http://elsewhere/leak.jpg"
await downloadTripPDF({ ...richArgs, trip: { ...richArgs.trip, cover_image: hostile } as any })
const iframe = getIframe()
const style = /<div class="cover-bg" style="([^"]*)"/.exec(iframe!.srcdoc)![1]
expect(style.split('url(')).toHaveLength(2)
expect(style.match(/'/g)).toHaveLength(2)
})
it('FE-COMP-TRIPPDF-015: renders accommodation section when accommodations exist', async () => {
server.use(
http.get('/api/trips/:id/accommodations', () =>
client/src/components/PDF/TripPDF.tsx
+8 -1
View File
@@ -81,6 +81,13 @@ function escHtml(str) {
return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
}
// The style attribute is decoded back into raw quotes before the CSS is parsed, so
// escHtml alone cannot stop a cover_image from closing the url() and appending its own
// declaration. Percent-encoding is transparent to the fetch.
function cssUrl(url) {
return String(url).replace(/["'()\\\s]/g, c => '%' + c.charCodeAt(0).toString(16).padStart(2, '0'))
}
function absUrl(url) {
if (!url) return null
if (url.startsWith('http://') || url.startsWith('https://') || url.startsWith('data:')) return url
@@ -703,7 +710,7 @@ export async function downloadTripPDF({ trip, days, places, assignments = {}, ca
<!-- Cover -->
<div class="cover">
${coverImg ? `<div class="cover-bg" style="background-image:url('${escHtml(coverImg)}')"></div>` : ''}
${coverImg ? `<div class="cover-bg" style="background-image:url('${escHtml(cssUrl(coverImg))}')"></div>` : ''}
<div class="cover-dim"></div>
<div class="cover-brand"><img src="${absUrl('/logo-light.svg')}" style="height:28px;opacity:0.5;" /></div>
<div class="cover-body">