test: pin the sanitizer allowlist and resource-policy boundaries #48

New Issue

2026-11-10T22:48:52Z

james.maes commented

2026-11-10 22:48:52 +00:00

Problem

The tests review ran 324 targeted mutants against main (8763ff3); 92 survived. This issue covers the Core ones that guard untrusted input:

The sanitizer's element, attribute and link-scheme allowlists are not pinned: widening them leaves every test green, and the fuzz corpus never generates several elements its own oracle forbids.
Resource-policy checks (scheme, port, credentials, file types, forbidden characters, device names) are tested with requests that are rejected for an unrelated reason, so removing a check goes unnoticed.
Reserved Windows device names are listed twice with different contents, and both lists depend on exact spelling.
Several validation checks have no test that only they reject (theme colours and labels, metadata escaping, per-property settings repair, schema approval, exact size limits).

Expected

One independent, exact pin for each allowlist.
Single-component variations for the resource policy.
One written-out rule for Windows reserved names and forbidden characters, used by both callers.
A killing test for each surviving mutant in these areas, or a note that the mutant is equivalent.

## Problem The tests review ran 324 targeted mutants against `main` (8763ff3); 92 survived. This issue covers the Core ones that guard untrusted input: - The sanitizer's element, attribute and link-scheme allowlists are not pinned: widening them leaves every test green, and the fuzz corpus never generates several elements its own oracle forbids. - Resource-policy checks (scheme, port, credentials, file types, forbidden characters, device names) are tested with requests that are rejected for an unrelated reason, so removing a check goes unnoticed. - Reserved Windows device names are listed twice with different contents, and both lists depend on exact spelling. - Several validation checks have no test that only they reject (theme colours and labels, metadata escaping, per-property settings repair, schema approval, exact size limits). ## Expected - One independent, exact pin for each allowlist. - Single-component variations for the resource policy. - One written-out rule for Windows reserved names and forbidden characters, used by both callers. - A killing test for each surviving mutant in these areas, or a note that the mutant is equivalent.

james.maes referenced this issue from a commit

2026-11-10 22:49:15 +00:00

test: pin the sanitizer allowlist and resource-policy boundaries

james.maes referenced a pull request that will close this issue

2026-11-10 22:49:15 +00:00

test: pin the sanitizer allowlist and resource-policy boundaries #49

james.maes referenced this issue from a commit

2026-11-10 23:19:06 +00:00

test: compare the configured allowlists as sets and reject undecodable theme text

james.maes referenced this issue from a commit

2026-11-10 23:44:22 +00:00

fix(themes): reject a theme with undecodable text or a repeated property anywhere