skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-15 15:46:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

Pin the token expression in the manual-edit-stash source assertion

Browse Source 
Review follow-up: the regex stopped at the literal ?token= and tolerated
anything after it, so removing the encoded token value from the URL
still passed. Requiring encodeURIComponent(TOKEN) right after the
prefix makes the mutation fail.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Paul Bakaus
2026-07-31 18:13:27 -07:00
co-authored by Claude Fable 5
parent 675656c18c
commit 60c860f022
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/live-browser-source.test.mjs
+1 -1
View File
@@ -42,7 +42,7 @@ describe('live-browser source contracts', () => {
);
assert.match(
SOURCE,
/fetch\('http:\/\/localhost:' \+ PORT \+ '\/manual-edit-stash\?token='[\s\S]{0,300}?pageUrl: location\.pathname[\s\S]{0,80}?element: extractContext\(contextElement\)[\s\S]{0,40}?ops,/,
/fetch\('http:\/\/localhost:' \+ PORT \+ '\/manual-edit-stash\?token=' \+ encodeURIComponent\(TOKEN\)[\s\S]{0,300}?pageUrl: location\.pathname[\s\S]{0,80}?element: extractContext\(contextElement\)[\s\S]{0,40}?ops,/,
'Save should stage edits through /manual-edit-stash with element context and ops',
);
assert.match(