@@ -773,6 +773,20 @@ describe("loadWebMedia", () => {
773773expect(result.contentType).toBe("text/markdown");
774774});
775775776+it("rejects host-read HTML files without a separate security-boundary approval", async () => {
777+const htmlFile = path.join(fixtureRoot, "report.html");
778+await fs.writeFile(htmlFile, "<!doctype html><title>Report</title><h1>Report</h1>\n", "utf8");
779+await expectLoadWebMediaErrorCode(
780+loadWebMedia(htmlFile, {
781+maxBytes: 1024 * 1024,
782+localRoots: "any",
783+readFile: async (filePath) => await fs.readFile(filePath),
784+hostReadCapability: true,
785+}),
786+"path-not-allowed",
787+);
788+});
789+776790it.each([
777791{
778792label: "ZIP",
@@ -833,6 +847,7 @@ describe("loadWebMedia", () => {
833847834848it.each([
835849{ label: "CSV", fileName: "opaque.csv" },
850+{ label: "HTML", fileName: "opaque.html" },
836851{ label: "Markdown", fileName: "opaque.md" },
837852])("rejects opaque non-NUL binary data disguised as %s", async ({ fileName }) => {
838853const fakeTextFile = path.join(fixtureRoot, fileName);
@@ -854,6 +869,7 @@ describe("loadWebMedia", () => {
854869855870it.each([
856871{ label: "CSV", fileName: "prefix-tail.csv" },
872+{ label: "HTML", fileName: "prefix-tail.html" },
857873{ label: "Markdown", fileName: "prefix-tail.md" },
858874])(
859875"rejects %s files with a text prefix and binary tail after the old sample window",
@@ -921,6 +937,7 @@ describe("loadWebMedia", () => {
921937922938it.each([
923939{ label: "CSV", fileName: "nul-padded.csv" },
940+{ label: "HTML", fileName: "nul-padded.html" },
924941{ label: "Markdown", fileName: "nul-padded.md" },
925942])("rejects NUL-padded binary data disguised as %s", async ({ fileName }) => {
926943const fakeTextFile = path.join(fixtureRoot, fileName);
@@ -944,6 +961,7 @@ describe("loadWebMedia", () => {
944961945962it.each([
946963{ label: "CSV", fileName: "bom-binary.csv" },
964+{ label: "HTML", fileName: "bom-binary.html" },
947965{ label: "Markdown", fileName: "bom-binary.md" },
948966])("rejects UTF-16 BOM-prefixed binary data disguised as %s", async ({ fileName }) => {
949967const fakeTextFile = path.join(fixtureRoot, fileName);
@@ -967,6 +985,7 @@ describe("loadWebMedia", () => {
967985968986it.each([
969987{ label: "CSV", fileName: "alternating-high.csv" },
988+{ label: "HTML", fileName: "alternating-high.html" },
970989{ label: "Markdown", fileName: "alternating-high.md" },
971990])("rejects alternating ASCII/high-byte data disguised as %s", async ({ fileName }) => {
972991const fakeTextFile = path.join(fixtureRoot, fileName);
@@ -991,6 +1010,7 @@ describe("loadWebMedia", () => {
99110109921011it.each([
9931012{ label: "CSV", fileName: "high-bytes.csv" },
1013+{ label: "HTML", fileName: "high-bytes.html" },
9941014{ label: "Markdown", fileName: "high-bytes.md" },
9951015])("rejects high-byte opaque data disguised as %s", async ({ fileName }) => {
9961016const fakeTextFile = path.join(fixtureRoot, fileName);
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。