aaronrene / knowtation public
task-loop-rrule-security.test.mjs
52 lines 1.4 KB
Raw
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ breaking 10 days ago
1 /**
2 * Tier 7 — SECURITY: Malicious RRULE strings and oversized input rejected.
3 */
4 import { describe, it } from 'node:test';
5 import assert from 'node:assert/strict';
6 import { validateTaskLoopRrule } from '../lib/task/task-loop-rrule.mjs';
7
8 const SERIES_TZ = 'America/Los_Angeles';
9
10 describe('Task loop RRULE — security rejects', () => {
11 it('rejects injection payload embedded in RRULE string', () => {
12 const result = validateTaskLoopRrule(
13 {
14 kind: 'rrule',
15 rrule: "FREQ=WEEKLY;BYDAY=MO;CMD=rm -rf /",
16 dtstart: '2026-06-02T16:00:00Z',
17 anchor_tz: SERIES_TZ,
18 },
19 SERIES_TZ,
20 );
21 assert.equal(result.ok, false);
22 });
23
24 it('rejects oversized RRULE input', () => {
25 const result = validateTaskLoopRrule(
26 {
27 kind: 'rrule',
28 rrule: `FREQ=WEEKLY;BYDAY=MO;X=${'A'.repeat(600)}`,
29 dtstart: '2026-06-02T16:00:00Z',
30 anchor_tz: SERIES_TZ,
31 },
32 SERIES_TZ,
33 );
34 assert.equal(result.ok, false);
35 if (!result.ok) assert.equal(result.detail, 'oversized');
36 });
37
38 it('rejects EXRULE token in v0 subset', () => {
39 const result = validateTaskLoopRrule(
40 {
41 kind: 'rrule',
42 rrule: 'FREQ=WEEKLY;EXRULE=FREQ=DAILY',
43 dtstart: '2026-06-02T16:00:00Z',
44 anchor_tz: SERIES_TZ,
45 exdates: [],
46 },
47 SERIES_TZ,
48 );
49 assert.equal(result.ok, false);
50 if (!result.ok) assert.equal(result.detail, 'EXRULE');
51 });
52 });
File History 1 commit
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ 10 days ago