From a830cce511c1e13abafcba46f674c86710650c5a Mon Sep 17 00:00:00 2001
From: chen <clean6378@gmail.com>
Date: Wed, 22 Jul 2026 04:22:41 +0800
Subject: [PATCH 1/2] test(xss): add Playwright gate for renderMarkdownSafe XSS
 vectors

---
 .github/workflows/tests.yml    |  30 ++++++
 pyproject.toml                 |   2 +
 tests/test_xss_browser.py      | 163 +++++++++++++++++++++++++++++++++
 tests/test_xss_sanitization.py |  10 +-
 4 files changed, 201 insertions(+), 4 deletions(-)
 create mode 100644 tests/test_xss_browser.py

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3a34c3d..9ce023b 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -132,6 +132,36 @@ jobs:
         if: matrix.os == 'windows-latest' && matrix.python-version == '3.12'
         run: dist\CursorChatBrowser\CursorChatBrowser.exe --help
 
+  # ── Browser XSS: Playwright (sprint item #3) ─────────────────────────────
+  browser-xss:
+    name: Browser XSS (Playwright)
+    needs: [lockfile]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime + browser test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-lock.txt
+          python -m pip install 'pytest>=8,<9' 'playwright==1.50.0'
+
+      - name: Install Chromium for Playwright
+        run: python -m playwright install chromium --with-deps
+
+      - name: Run headless XSS browser tests
+        run: python -m pytest tests/test_xss_browser.py -v --tb=short -o addopts=
+
+      - name: Run static XSS grep backstop
+        run: python -m unittest tests.test_xss_sanitization -v
+
   # ── Typecheck: mypy ───────────────────────────────────────────────────────
   # strict = true in pyproject.toml (issue #100). Per-module overrides skip
   # scripts/export.py and tests/ until those surfaces are fully annotated.
diff --git a/pyproject.toml b/pyproject.toml
index c9dc62e..05496cb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,6 +34,7 @@ dev = [
     "pytest-benchmark>=4,<5",
     "mypy>=1.10,<2",
     "hypothesis>=6.100,<7",
+    "playwright==1.50.0",
 ]
 
 [tool.pytest.ini_options]
@@ -43,6 +44,7 @@ addopts = "--benchmark-skip"
 testpaths = ["tests"]
 markers = [
     "benchmark: performance benchmarks (pytest-benchmark)",
+    "browser: headless browser tests (Playwright)",
 ]
 
 [project.scripts]
diff --git a/tests/test_xss_browser.py b/tests/test_xss_browser.py
new file mode 100644
index 0000000..8ae7a94
--- /dev/null
+++ b/tests/test_xss_browser.py
@@ -0,0 +1,163 @@
+"""
+Headless-browser XSS regression tests (issue #11 / sprint item #3).
+
+Exercises the production render path: Marked.js + DOMPurify via
+renderMarkdownSafe() in static/js/app.js, then DOM insertion via innerHTML
+(the same pattern as templates/workspace.html).
+
+Pages are served with the same CSP as production; inline event handlers are
+blocked by the header, so these tests assert dangerous markup is stripped from
+the sink (and use a probe where execution is still observable).
+
+Static source greps live in tests/test_xss_sanitization.py.
+
+Run:
+    playwright install chromium
+    pytest -q tests/test_xss_browser.py
+"""
+
+from __future__ import annotations
+
+import threading
+from typing import Any, Generator
+
+import pytest
+from playwright.sync_api import Page, sync_playwright
+from werkzeug.serving import make_server
+
+from app import create_app
+
+# Representative vectors from the sprint issue.
+XSS_VECTORS: list[tuple[str, str]] = [
+    ("img_onerror", '<img src=x onerror="window.__xssProbe=1">'),
+    ("script_tag", "<script>window.__xssProbe=1</script>"),
+    ("javascript_uri", "[x](javascript:window.__xssProbe=1)"),
+    (
+        "svg_onload",
+        '<svg xmlns="http://www.w3.org/2000/svg" onload="window.__xssProbe=1"></svg>',
+    ),
+]
+
+_PROBE_SETTLE_MS = 150
+
+_INSPECT_XSS_SINK = f"""
+async ({{ payload, useSafeRender }}) => {{
+  window.__xssProbe = 0;
+  const host = document.getElementById('xss-browser-test-host');
+  if (host) {{
+    host.remove();
+  }}
+  const el = document.createElement('div');
+  el.id = 'xss-browser-test-host';
+  document.body.appendChild(el);
+  if (useSafeRender) {{
+    if (typeof renderMarkdownSafe !== 'function') {{
+      throw new Error('renderMarkdownSafe is not defined — is app.js loaded?');
+    }}
+    el.innerHTML = renderMarkdownSafe(payload);
+  }} else {{
+    const html = marked.parse(payload, {{ breaks: true, gfm: true }});
+    el.innerHTML = html;
+  }}
+  await new Promise((resolve) => setTimeout(resolve, {_PROBE_SETTLE_MS}));
+  const result = {{
+    probe: window.__xssProbe || 0,
+    onerrorAttr: el.querySelector('[onerror]') !== null,
+    scriptTag: el.querySelector('script') !== null,
+    jsHref: el.querySelector('[href^="javascript:"]') !== null,
+    svgOnload: el.querySelector('svg[onload]') !== null,
+  }};
+  if (!useSafeRender) {{
+    result.html = el.innerHTML;
+  }}
+  return result;
+}}
+"""
+
+
+def _assert_sink_neutralized(result: dict[str, Any], vector_name: str) -> None:
+    assert result["probe"] == 0, (
+        f"XSS probe fired for vector {vector_name!r}; "
+        "renderMarkdownSafe must neutralize this payload"
+    )
+    assert not result["onerrorAttr"], (
+        f"onerror attribute survived sanitization for {vector_name!r}"
+    )
+    assert not result["scriptTag"], (
+        f"<script> survived sanitization for {vector_name!r}"
+    )
+    assert not result["jsHref"], (
+        f"javascript: URI survived sanitization for {vector_name!r}"
+    )
+    assert not result["svgOnload"], (
+        f"svg onload survived sanitization for {vector_name!r}"
+    )
+
+
+@pytest.fixture(scope="module")
+def playwright_browser():
+    with sync_playwright() as playwright:
+        browser = playwright.chromium.launch(headless=True)
+        yield browser
+        browser.close()
+
+
+@pytest.fixture
+def browser_page(playwright_browser) -> Generator[Page, None, None]:
+    page = playwright_browser.new_page()
+    try:
+        yield page
+    finally:
+        page.close()
+
+
+@pytest.fixture
+def live_server_url(workspace_storage: str) -> Generator[str, None, None]:
+    app = create_app()
+    app.config["TESTING"] = True
+    app.config["EXCLUSION_RULES"] = []
+    server = make_server("127.0.0.1", 0, app)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    host, port = server.server_address[:2]
+    try:
+        yield f"http://{host}:{port}"
+    finally:
+        server.shutdown()
+
+
+@pytest.fixture
+def app_page(browser_page: Page, live_server_url: str) -> Page:
+    """Any HTML page that loads base.html scripts (marked, DOMPurify, app.js)."""
+    response = browser_page.goto(f"{live_server_url}/", wait_until="networkidle")
+    assert response is not None and response.ok
+    browser_page.wait_for_function(
+        "() => typeof renderMarkdownSafe === 'function' && typeof DOMPurify !== 'undefined'"
+    )
+    return browser_page
+
+
+@pytest.mark.browser
+@pytest.mark.parametrize("vector_name,payload", XSS_VECTORS, ids=[v[0] for v in XSS_VECTORS])
+def test_render_markdown_safe_neutralizes_xss_vector(
+    app_page: Page, vector_name: str, payload: str
+) -> None:
+    result = app_page.evaluate(
+        _INSPECT_XSS_SINK, {"payload": payload, "useSafeRender": True}
+    )
+    _assert_sink_neutralized(result, vector_name)
+
+
+@pytest.mark.browser
+def test_bare_marked_parse_leaves_dangerous_markup_negative_control(
+    app_page: Page,
+) -> None:
+    """Without DOMPurify.sanitize, marked output still carries exploitable markup."""
+    payload = XSS_VECTORS[0][1]
+    result = app_page.evaluate(
+        _INSPECT_XSS_SINK, {"payload": payload, "useSafeRender": False}
+    )
+    assert result["onerrorAttr"] or result["scriptTag"], (
+        "negative control: bare marked.parse should leave at least one dangerous "
+        "node/attribute in the DOM sink"
+    )
diff --git a/tests/test_xss_sanitization.py b/tests/test_xss_sanitization.py
index 7348e55..d73d482 100644
--- a/tests/test_xss_sanitization.py
+++ b/tests/test_xss_sanitization.py
@@ -9,13 +9,15 @@
      (workspace.html → innerHTML) or a downloadable HTML blob (download.js).
   4. Never call marked.parse(...) without a DOMPurify.sanitize(...) wrap.
 
-These checks are static-source assertions — there is no JS test runner in
-this repo, but a future regression that re-introduces a bare marked.parse
-call would slip past every dynamic test even if one existed. Source-grep
-guards are the cheapest backstop.
+These checks are static-source assertions — a future regression that
+re-introduces a bare marked.parse call would slip past the headless browser
+suite if nobody exercised that path. Source-grep guards are the cheap backstop;
+authoritative execution checks live in tests/test_xss_browser.py (Playwright).
 
 Run:
     python -m unittest tests.test_xss_sanitization -v
+    playwright install chromium
+    pytest -q tests/test_xss_browser.py
 """
 
 import glob

From c5c4f6a843888b07f2a0e0915aa97f495759869c Mon Sep 17 00:00:00 2001
From: chen <clean6378@gmail.com>
Date: Wed, 22 Jul 2026 05:10:04 +0800
Subject: [PATCH 2/2] test(xss): lazy-load Playwright for unittest and assert
 DOMPurify.sanitize runs

---
 tests/test_xss_browser.py | 76 ++++++++++++++++++++++++++-------------
 1 file changed, 52 insertions(+), 24 deletions(-)

diff --git a/tests/test_xss_browser.py b/tests/test_xss_browser.py
index 8ae7a94..81e5ae5 100644
--- a/tests/test_xss_browser.py
+++ b/tests/test_xss_browser.py
@@ -19,14 +19,16 @@
 from __future__ import annotations
 
 import threading
-from typing import Any, Generator
+from typing import TYPE_CHECKING, Any, Generator
 
 import pytest
-from playwright.sync_api import Page, sync_playwright
 from werkzeug.serving import make_server
 
 from app import create_app
 
+if TYPE_CHECKING:
+    from playwright.sync_api import Page
+
 # Representative vectors from the sprint issue.
 XSS_VECTORS: list[tuple[str, str]] = [
     ("img_onerror", '<img src=x onerror="window.__xssProbe=1">'),
@@ -50,27 +52,46 @@
   const el = document.createElement('div');
   el.id = 'xss-browser-test-host';
   document.body.appendChild(el);
+  let sanitizeCalls = 0;
+  let restoreSanitize = null;
   if (useSafeRender) {{
-    if (typeof renderMarkdownSafe !== 'function') {{
-      throw new Error('renderMarkdownSafe is not defined — is app.js loaded?');
-    }}
-    el.innerHTML = renderMarkdownSafe(payload);
-  }} else {{
-    const html = marked.parse(payload, {{ breaks: true, gfm: true }});
-    el.innerHTML = html;
+    const originalSanitize = DOMPurify.sanitize.bind(DOMPurify);
+    DOMPurify.sanitize = (...args) => {{
+      sanitizeCalls += 1;
+      return originalSanitize(...args);
+    }};
+    restoreSanitize = () => {{
+      DOMPurify.sanitize = originalSanitize;
+    }};
   }}
-  await new Promise((resolve) => setTimeout(resolve, {_PROBE_SETTLE_MS}));
-  const result = {{
-    probe: window.__xssProbe || 0,
-    onerrorAttr: el.querySelector('[onerror]') !== null,
-    scriptTag: el.querySelector('script') !== null,
-    jsHref: el.querySelector('[href^="javascript:"]') !== null,
-    svgOnload: el.querySelector('svg[onload]') !== null,
-  }};
-  if (!useSafeRender) {{
-    result.html = el.innerHTML;
+  try {{
+    if (useSafeRender) {{
+      if (typeof renderMarkdownSafe !== 'function') {{
+        throw new Error('renderMarkdownSafe is not defined — is app.js loaded?');
+      }}
+      el.innerHTML = renderMarkdownSafe(payload);
+    }} else {{
+      const html = marked.parse(payload, {{ breaks: true, gfm: true }});
+      el.innerHTML = html;
+    }}
+    await new Promise((resolve) => setTimeout(resolve, {_PROBE_SETTLE_MS}));
+    const result = {{
+      probe: window.__xssProbe || 0,
+      onerrorAttr: el.querySelector('[onerror]') !== null,
+      scriptTag: el.querySelector('script') !== null,
+      jsHref: el.querySelector('[href^="javascript:"]') !== null,
+      svgOnload: el.querySelector('svg[onload]') !== null,
+      sanitizeCalls: useSafeRender ? sanitizeCalls : 0,
+    }};
+    if (!useSafeRender) {{
+      result.html = el.innerHTML;
+    }}
+    return result;
+  }} finally {{
+    if (restoreSanitize) {{
+      restoreSanitize();
+    }}
   }}
-  return result;
 }}
 """
 
@@ -92,10 +113,17 @@ def _assert_sink_neutralized(result: dict[str, Any], vector_name: str) -> None:
     assert not result["svgOnload"], (
         f"svg onload survived sanitization for {vector_name!r}"
     )
+    assert result.get("sanitizeCalls", 0) >= 1, (
+        f"DOMPurify.sanitize was not called for {vector_name!r}; "
+        "renderMarkdownSafe must not take the escapeHtml-only path for these payloads"
+    )
 
 
 @pytest.fixture(scope="module")
 def playwright_browser():
+    pytest.importorskip("playwright")
+    from playwright.sync_api import sync_playwright
+
     with sync_playwright() as playwright:
         browser = playwright.chromium.launch(headless=True)
         yield browser
@@ -103,7 +131,7 @@ def playwright_browser():
 
 
 @pytest.fixture
-def browser_page(playwright_browser) -> Generator[Page, None, None]:
+def browser_page(playwright_browser) -> Generator["Page", None, None]:
     page = playwright_browser.new_page()
     try:
         yield page
@@ -127,7 +155,7 @@ def live_server_url(workspace_storage: str) -> Generator[str, None, None]:
 
 
 @pytest.fixture
-def app_page(browser_page: Page, live_server_url: str) -> Page:
+def app_page(browser_page: "Page", live_server_url: str) -> "Page":
     """Any HTML page that loads base.html scripts (marked, DOMPurify, app.js)."""
     response = browser_page.goto(f"{live_server_url}/", wait_until="networkidle")
     assert response is not None and response.ok
@@ -140,7 +168,7 @@ def app_page(browser_page: Page, live_server_url: str) -> Page:
 @pytest.mark.browser
 @pytest.mark.parametrize("vector_name,payload", XSS_VECTORS, ids=[v[0] for v in XSS_VECTORS])
 def test_render_markdown_safe_neutralizes_xss_vector(
-    app_page: Page, vector_name: str, payload: str
+    app_page: "Page", vector_name: str, payload: str
 ) -> None:
     result = app_page.evaluate(
         _INSPECT_XSS_SINK, {"payload": payload, "useSafeRender": True}
@@ -150,7 +178,7 @@ def test_render_markdown_safe_neutralizes_xss_vector(
 
 @pytest.mark.browser
 def test_bare_marked_parse_leaves_dangerous_markup_negative_control(
-    app_page: Page,
+    app_page: "Page",
 ) -> None:
     """Without DOMPurify.sanitize, marked output still carries exploitable markup."""
     payload = XSS_VECTORS[0][1]