From 60c860f022c4dbc84870e8abc502402b1b81f23f Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Fri, 31 Jul 2026 18:13:27 -0700 Subject: [PATCH] Pin the token expression in the manual-edit-stash source assertion Review follow-up: the regex stopped at the literal ?token= and tolerated anything after it, so removing the encoded token value from the URL still passed. Requiring encodeURIComponent(TOKEN) right after the prefix makes the mutation fail. Co-Authored-By: Claude Fable 5 --- tests/live-browser-source.test.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/live-browser-source.test.mjs b/tests/live-browser-source.test.mjs index 0f031bc86..af03f023d 100644 --- a/tests/live-browser-source.test.mjs +++ b/tests/live-browser-source.test.mjs @@ -42,7 +42,7 @@ describe('live-browser source contracts', () => { ); assert.match( SOURCE, - /fetch\('http:\/\/localhost:' \+ PORT \+ '\/manual-edit-stash\?token='[\s\S]{0,300}?pageUrl: location\.pathname[\s\S]{0,80}?element: extractContext\(contextElement\)[\s\S]{0,40}?ops,/, + /fetch\('http:\/\/localhost:' \+ PORT \+ '\/manual-edit-stash\?token=' \+ encodeURIComponent\(TOKEN\)[\s\S]{0,300}?pageUrl: location\.pathname[\s\S]{0,80}?element: extractContext\(contextElement\)[\s\S]{0,40}?ops,/, 'Save should stage edits through /manual-edit-stash with element context and ops', ); assert.match(