'); + // API renderers supply formatted Markdown: leave unrelated escapes and code paths alone. + // This encodes table delimiters, not arbitrary code spans containing literal \|. + return value + .replace(/\\*\|/g, (delimiter) => delimiter.replace(/[\\|]/g, '\\$&')) + .replace(/\r\n|\r|\n/g, '
'); } export function link(label: string, href: string): string { diff --git a/src/frontend/src/utils/sample-readme-headings.ts b/src/frontend/src/utils/sample-readme-headings.ts index d8fbf4a34..08a4d3b48 100644 --- a/src/frontend/src/utils/sample-readme-headings.ts +++ b/src/frontend/src/utils/sample-readme-headings.ts @@ -9,7 +9,8 @@ export function stripReadmeTitle(readme: string): string { } /** - * Lower-cases, strips punctuation, and collapses whitespace into a stable + * Accepts plain text from `headingPlainText`, not HTML. Lower-cases, strips + * punctuation, and collapses whitespace into a stable * `kebab-case` id, mirroring Starlight's heading-slugger so anchor links * resolve. Returns `'section'` as a fallback when the input collapses to * an empty string. @@ -18,7 +19,6 @@ export function slugifyHeading(value: string): string { const slug = value .toLowerCase() .trim() - .replace(/<[^>]*>/g, '') .replace(/[^\p{Letter}\p{Number}\s-]/gu, '') .replace(/\s+/g, '-') .replace(/-+/g, '-') diff --git a/src/frontend/tests/unit/api-markdown.vitest.test.ts b/src/frontend/tests/unit/api-markdown.vitest.test.ts index 159015258..5b32213c8 100644 --- a/src/frontend/tests/unit/api-markdown.vitest.test.ts +++ b/src/frontend/tests/unit/api-markdown.vitest.test.ts @@ -6,7 +6,13 @@ -- route module imports and test props are intentionally dynamic in this harness */ import { describe, expect, it, vi } from 'vitest'; +import { createMarkdownProcessor } from '@astrojs/markdown-remark'; +import { selectAll } from 'hast-util-select'; +import { toHtml } from 'hast-util-to-html'; +import rehypeParse from 'rehype-parse'; +import { unified } from 'unified'; +import { escapeTableCell } from '@utils/api-markdown-shared'; import { renderCSharpDocMarkdown, renderCSharpMemberKindMarkdown, @@ -236,6 +242,92 @@ describe('API markdown routes', () => { }); describe('API markdown helpers', () => { + const tableProcessor = createMarkdownProcessor({ smartypants: false, syntaxHighlight: false }); + + async function renderCell(value: string) { + const processor = await tableProcessor; + const result = await processor.render( + `| Value | Sentinel |\n| --- | --- |\n| ${escapeTableCell(value)} | intact |` + ); + const tree = unified().use(rehypeParse, { fragment: true }).parse(result.code); + expect(selectAll('tbody tr', tree)).toHaveLength(1); + const cells = selectAll('td', tree); + expect(cells).toHaveLength(2); + expect(toHtml(cells[1])).toBe('
left|middle|rightsecond
C:\\src\\app and C:\\src\\app\\C:\\src\\app | left|rightC:\\src | D:\\data after\\|endC:\\src\\appleft|right and first second%LocalAppData%\\Aspire\\BrowserData-
@@ -121,10 +158,11 @@ await broadcaster.UpdateAsync(
return Results.Ok();
}
case "revocation":
- logger.LogWarning("Twitch EventSub subscription revoked: {Body}", bodyJson);
+ LogRevocation(bodyJson, logger);
return Results.NoContent();
default:
- logger.LogDebug("Twitch webhook of unknown message-type {Type}", messageType);
+ logger.LogDebug("Twitch webhook of unknown message type {MessageType} (sanitized).",
+ SanitizeDiagnosticValue(messageType));
return Results.Ok();
}
}
diff --git a/tests/StaticHost.Tests/Live/LiveEndpointsTests.cs b/tests/StaticHost.Tests/Live/LiveEndpointsTests.cs
index e6edbed22..15006b069 100644
--- a/tests/StaticHost.Tests/Live/LiveEndpointsTests.cs
+++ b/tests/StaticHost.Tests/Live/LiveEndpointsTests.cs
@@ -156,6 +156,129 @@ await server.Broadcaster.UpdateAsync(new LiveStatusUpdate
Assert.Equal(HttpStatusCode.OK, replayResponse.StatusCode);
AssertNoStore(replayResponse);
Assert.False((await server.Broadcaster.GetCurrentAsync()).Twitch.Live);
+ Assert.Contains(server.Logs.Entries, entry =>
+ entry.Fields.TryGetValue("MessageId", out var id) && Equals(id, "test-message-1"));
+ }
+
+ [Fact]
+ public async Task TwitchWebhook_SignedUnparseableTimestamp_IsRejectedWithSanitizedHeader()
+ {
+ await using var server = await LiveHttpServer.StartAsync();
+ using var request = TwitchRequest(server, "notification", "{}",
+ timestamp: LiveTestHelpers.LogInjectionPayload);
+ using var response = await server.Client.SendAsync(request);
+
+ Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+ AssertNoStore(response);
+ Assert.False((await server.Broadcaster.GetCurrentAsync()).IsLive);
+ var entry = Assert.Single(server.Logs.Entries);
+ Assert.Equal(LogLevel.Warning, entry.Level);
+ Assert.Equal("payload-sentinel__forged-line___", entry.Fields["Timestamp"]);
+ Assert.Equal("Twitch webhook timestamp payload-sentinel__forged-line___ (sanitized) is stale or unparseable; rejecting.",
+ entry.Message);
+ Assert.Null(entry.Exception);
+ Assert.Equal(2, entry.Fields.Count);
+ }
+
+ [Theory]
+ [InlineData(-11)]
+ [InlineData(5)]
+ public async Task TwitchWebhook_RejectedTimestamp_RetainsDiagnosticValue(int minutesFromNow)
+ {
+ await using var server = await LiveHttpServer.StartAsync();
+ var timestamp = server.Time.GetUtcNow().AddMinutes(minutesFromNow).ToString("O");
+ using var request = TwitchRequest(server, "notification", "{}", timestamp: timestamp);
+ using var response = await server.Client.SendAsync(request);
+
+ Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+ AssertNoStore(response);
+ var entry = Assert.Single(server.Logs.Entries);
+ Assert.Equal(timestamp, entry.Fields["Timestamp"]);
+ Assert.Contains(timestamp, entry.Message);
+ LiveTestHelpers.AssertSafeLogs(server.Logs);
+ }
+
+ [Theory]
+ [InlineData(true)]
+ [InlineData(false)]
+ public async Task TwitchWebhook_SignedDuplicateId_IsLoggedSafely(bool completed)
+ {
+ await using var server = await LiveHttpServer.StartAsync();
+ const string messageId = LiveTestHelpers.LogInjectionPayload;
+ var acquisition = await server.Coordination.AcquireTwitchMessageAsync(messageId);
+ Assert.Equal(TwitchMessageAcquisitionStatus.Acquired, acquisition.Status);
+ await using (var lease = Assert.IsAssignableFrom