vault-security: the XSS checks asserted the escaped payload was absent from rendered text, which fails on correct escaping — assert instead that no script element, img or inline handler is ever created, and that GET_ENTRIES answers vault_locked once locked

@@ -1,8 +1,5 @@11 import { test, expect, type BrowserContext, type Page } from "@playwright/test";2-import { join } from "path";3-import os from "os";4-import fs from "fs/promises";5-import { EXTENSION_PATH, addEntry, loadPopup, makeContext, openSettings, setupVault, waitForSW } from "./helpers/vault";2+import { addEntry, loadPopup, makeContext, openSettings, setupVault, waitForSW } from "./helpers/vault";63 74 // Real vault creation runs Argon2id (≈12s with the recovery confirmation).85 test.describe.configure({ timeout: 90_000 });@@ -85,14 +82,10 @@8582   });8683 });8784 85+// Headless Chrome never registers the extension service worker, so this runs86+// headed like every other spec.8887 test("ST09 - lock screen pre-rendered HTML is attached before JS runs", async () => {89-  const { chromium } = await import("playwright");90-  const userDataDir = join(os.tmpdir(), `peach-prelock-${Date.now()}`);91-  await fs.mkdir(userDataDir, { recursive: true });92-  const ctx = await chromium.launchPersistentContext(userDataDir, {93-    headless: true,94-    args: [`--load-extension=${EXTENSION_PATH}`, `--disable-extensions-except=${EXTENSION_PATH}`],95-  });88+  const ctx = await makeContext("peach-prelock");9689   const extId = await waitForSW(ctx);9790   const page = await ctx.newPage();9891   await page.goto(`chrome-extension://${extId}/src/popup/index.html`);

@@ -37,9 +37,13 @@3737   test("SECX01 - entry titles are escaped in DOM", async () => {3838     const { popup } = await setupVault(ctx);3939     await createEntryViaForm(popup, { title: '<script>alert("xss")</script>', url: "https://xss.com", username: "[email protected]", password: "xss" });40+    // The old assertion demanded the title NOT contain "<script>" in its text —41+    // but correct escaping renders it as visible text, so that check failed on42+    // correct behaviour. The real invariant is that no script element is43+    // created from a title.4044     const entryName = popup.locator(".peach-entry-name").first();41-    const text = await entryName.textContent();42-    expect(text).not.toContain("<script>");45+    expect(await entryName.textContent()).toContain("alert");46+    expect(await popup.locator("script:not([src])").count()).toBe(0);4347     await ctx.close();4448   });4549 @@ -55,20 +59,23 @@5559   test("SECX03 - no inline event handlers in entry rendering", async () => {5660     const { popup } = await setupVault(ctx);5761     await createEntryViaForm(popup, { title: '" onmouseover="alert(1)" "', url: "https://test.com", username: "[email protected]", password: "pass" });58-    const entry = popup.locator(".peach-entry-name").first();59-    const html = await entry.innerHTML();60-    expect(html).not.toContain("onmouseover");62+    // Same shape as SECX01: the handler text is rendered as text, so assert no63+    // element actually carries an onmouseover attribute.64+    const injected = await popup.evaluate(() =>65+      document.querySelectorAll("[onmouseover]").length,66+    );67+    expect(injected).toBe(0);6168     await ctx.close();6269   });6370 6471   test("SECX04 - notes field renders without HTML execution", async () => {6572     const { popup } = await setupVault(ctx);6673     await createEntryViaForm(popup, { title: "NotesXSS", url: "https://notes.com", username: "[email protected]", password: "pass", notes: '<img src=x onerror="alert(1)">' });67-    await popup.locator(".peach-entry-name-button").first().click();68-    await popup.waitForTimeout(500);69-    const noteContent = popup.locator(".peach-note-content").first();70-    const html = await noteContent.innerHTML().catch(() => "");71-    expect(html).not.toContain("onerror");74+    // Notes render as a text node, so the markup survives as visible text —75+    // the invariant is that no <img> is created and no handler is installed.76+    await expect(popup.locator(".peach-note-content")).toContainText("onerror");77+    expect(await popup.locator(".peach-note-content img").count()).toBe(0);78+    expect(await popup.evaluate(() => document.querySelectorAll("[onerror]").length)).toBe(0);7279     await ctx.close();7380   });7481 @@ -79,8 +86,10 @@7986     const searchInput = listSearch(popup);8087     await searchInput.fill('<script>alert("xss")</script>');8188     await popup.waitForTimeout(300);82-    const value = await searchInput.inputValue();83-    expect(value).not.toContain("<script>");89+    // An input legitimately holds whatever was typed; what must not happen is90+    // the query becoming markup somewhere in the list.91+    expect(await searchInput.inputValue()).toContain("<script>");92+    expect(await popup.locator("script:not([src])").count()).toBe(0);8493     await ctx.close();8594   });8695 });