mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-15 23:56:29 +03:00
Paul BakausandClaude Fable 5.1
0547ed6a63
The engine no longer lives in a separate repo. `crates/` is a snapshot of the
open crates (foundation, core, common, context, live, hook, skills, comp,
comp-verbs, html, browser, detect, cli) plus `Cargo.lock`, taken as a git
archive of the engine repo at the commit that finished the boundary split.
None of that repo's history comes with it, and none of it should: the closed
half stays private.
The closed half is the rule engine. It ships as a prebuilt native archive per
target, `libimpeccable_detector.a`, published as a `detector-v<X>` GitHub
Release on this repo. `crates/core/build.rs` resolves and links it three ways:
`IMPECCABLE_DETECTOR_LIB=<dir>` for a local detector build, else the
`~/.impeccable/detector/<version>/<target>/` cache, else a download verified
against its `.sha256` sidecar. `crates/core` is a thin shim over a three-symbol
C ABI; nothing above it knows the boundary exists.
What changed versus the engine repo copy:
- Every crate manifest moves from `license-file.workspace` to
`license.workspace` (this workspace declares Apache-2.0), and the workspace
gains the `postcard` dependency the boundary encoding needs.
- The launcher contract test reads `skill/scripts/impeccable{,.cmd}` instead of
a sibling `launcher/` dir, and `engine_binary` downloads from
`github.com/pbakaus/impeccable/releases/download/engine-v<version>/` instead
of the retired dist repo. No oracle golden carried the old URL, so no
re-recording was owed.
- The tests that hunted for a public repo through `IMPECCABLE_PUBLIC_REPO`,
`../impeccable-second` or a hardcoded home directory now resolve the root as
`CARGO_MANIFEST_DIR/../..`, because they are in it. The env var stays as an
override for an out-of-tree checkout.
- The in-page bundle (`detect-antipatterns-browser.js`, 2 MB of generated wasm
glue) is no longer tracked. `crates/core/build.rs` resolves it beside the
archive, hands the path to `impeccable_core::browser::IN_PAGE_BUNDLE_JS`, and
live mode serves that. `scripts/check-detector-release.mjs` now requires it
and its `.sha256` in a detector release.
- The live crate embeds `skill/scripts/live-browser*.js` and
`modern-screenshot.umd.js` directly rather than through vendored copies, so
the binary and the installed skill cannot drift.
- `crates/browser/assets/` (an unused second copy of the bundle) is gone.
- `tests/lib/engine-bin.mjs` also accepts `target/release/impeccable`, so a
plain `cargo build --release -p impeccable` is enough to run `bun run test`.
Verified with the archive from a local detector build: `cargo test --workspace`
267 pass, oracle 795 pass / 0 fail / 0 missing, `bun run build` clean, the
default suite green, and the launcher's `engine-probe` handshake answering
through `skill/scripts/impeccable`.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
93 lines
3.2 KiB
Rust
93 lines
3.2 KiB
Rust
//! Triage D2: the URL engine must scan passively — with `Page.setBypassCSP`
|
|
//! removed, a strict-CSP page's CSP-blocked inline scripts must NOT run during
|
|
//! a scan (they did under the old `setBypassCSP(true)` setup).
|
|
//!
|
|
//! This serves a page with `Content-Security-Policy: script-src 'self'` and an
|
|
//! inline `<script>` that a strict CSP blocks. The script, if it ran, would set
|
|
//! a global and mutate a marker element. The test drives the browser exactly as
|
|
//! the engine does (its page setup no longer bypasses CSP) and asserts the side
|
|
//! effect did not fire. Skips cleanly with no installed browser.
|
|
|
|
use std::collections::HashMap;
|
|
use std::io::{Read, Write};
|
|
use std::net::{TcpListener, TcpStream};
|
|
use std::time::Duration;
|
|
|
|
const PAGE: &str = r#"<!doctype html>
|
|
<html><head><meta charset="utf-8">
|
|
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
|
|
<title>csp passivity</title></head>
|
|
<body>
|
|
<div id="marker">clean</div>
|
|
<script>
|
|
// Blocked by `script-src 'self'` (no nonce/hash). Ran only under setBypassCSP.
|
|
window.__impeccableSideEffect = true;
|
|
document.getElementById('marker').textContent = 'SIDE-EFFECT-FIRED';
|
|
</script>
|
|
</body></html>
|
|
"#;
|
|
|
|
fn serve_once() -> u16 {
|
|
let listener = TcpListener::bind("127.0.0.1:0").expect("bind");
|
|
let port = listener.local_addr().unwrap().port();
|
|
std::thread::spawn(move || {
|
|
for stream in listener.incoming().flatten() {
|
|
std::thread::spawn(move || handle(stream));
|
|
}
|
|
});
|
|
port
|
|
}
|
|
|
|
fn handle(mut stream: TcpStream) {
|
|
let mut buf = [0u8; 4096];
|
|
let _ = stream.read(&mut buf);
|
|
let body = PAGE.as_bytes();
|
|
let head = format!(
|
|
"HTTP/1.0 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
|
|
body.len()
|
|
);
|
|
let _ = stream.write_all(head.as_bytes());
|
|
let _ = stream.write_all(body);
|
|
let _ = stream.flush();
|
|
}
|
|
|
|
#[test]
|
|
fn strict_csp_inline_script_does_not_run_during_scan() {
|
|
let env: HashMap<String, String> = std::env::vars().collect();
|
|
let Ok(exe) = impeccable_browser::discovery::find_browser(&env) else {
|
|
eprintln!("skip: no installed browser found");
|
|
return;
|
|
};
|
|
let mut browser = match impeccable_browser::cdp::Browser::launch(&exe, &[], false) {
|
|
Ok(b) => b,
|
|
Err(e) => {
|
|
eprintln!("skip: could not launch browser: {}", e.message);
|
|
return;
|
|
}
|
|
};
|
|
let port = serve_once();
|
|
let url = format!("http://127.0.0.1:{port}/");
|
|
let mut page = browser.new_page().expect("new page");
|
|
page.goto(&url, "networkidle0", Duration::from_secs(30))
|
|
.expect("goto");
|
|
|
|
let fired = page
|
|
.evaluate_value("window.__impeccableSideEffect === true")
|
|
.expect("eval side-effect flag");
|
|
let marker = page
|
|
.evaluate_value("document.getElementById('marker').textContent")
|
|
.expect("eval marker");
|
|
page.close();
|
|
|
|
assert_eq!(
|
|
fired.as_bool(),
|
|
Some(false),
|
|
"strict-CSP inline script ran during the scan (CSP was bypassed)"
|
|
);
|
|
assert_eq!(
|
|
marker.as_str(),
|
|
Some("clean"),
|
|
"marker was mutated by a CSP-blocked inline script (CSP was bypassed)"
|
|
);
|
|
}
|