ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-03 04:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(player): report and fail closed on runtime delivery errors (#3472)

Browse Source 
* feat(player): report runtime data application

* fix(player): fail closed on runtime data delivery

* fix(player): close runtime delivery and sandbox gaps

* fix(player): satisfy runtime contract and CodeQL

* refactor(player): simplify runtime tag scanner

* style(player): apply repository formatter

* fix(player): type runtime tag boundaries

* fix(core): mint guest-local runtime-data ids in a separate space from host ids
This commit is contained in:
Vance Ingalls
2026-08-30 13:00:14 -07:00
committed by GitHub
parent 3337cc8990
commit 859ac622c2
20 changed files with 632 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/player/tests/browser/sandbox-origin.ts
+53
View File
@@ -0,0 +1,53 @@
import assert from "node:assert/strict";
import { launchBrowser } from "../perf/runner.js";
import { startServer } from "../perf/server.js";
const server = startServer();
const browser = await launchBrowser();
try {
const page = await browser.newPage();
await page.goto(`${server.origin}/host.html?fixture=sandbox-probe`, {
waitUntil: "domcontentloaded",
});
await page.waitForFunction(() => (window.__sandboxProbeResults?.length ?? 0) >= 1);
assert.equal(
await page.evaluate(() => window.__sandboxProbeResults?.at(-1)),
true,
"the default trusted sandbox should allow same-origin parent access",
);
await page.evaluate(() => {
document.querySelector("hyperframes-player")?.setAttribute("sandbox-origin", "opaque");
});
await page.waitForFunction(() => (window.__sandboxProbeResults?.length ?? 0) >= 2);
assert.equal(
await page.evaluate(() => window.__sandboxProbeResults?.at(-1)),
false,
"switching a live player to opaque must reload into an isolated origin",
);
await page.evaluate(() => {
document.querySelector("hyperframes-player")?.setAttribute("sandbox-origin", "opaqu");
});
await page.waitForFunction(() => (window.__sandboxProbeResults?.length ?? 0) >= 3);
assert.equal(
await page.evaluate(() => window.__sandboxProbeResults?.at(-1)),
false,
"an unrecognized non-null policy must remain isolated",
);
await page.evaluate(() => {
document.querySelector("hyperframes-player")?.removeAttribute("sandbox-origin");
});
await page.waitForFunction(() => (window.__sandboxProbeResults?.length ?? 0) >= 4);
assert.equal(
await page.evaluate(() => window.__sandboxProbeResults?.at(-1)),
true,
"removing the policy must reload into the documented trusted mode",
);
} finally {
await browser.close();
await server.stop();
}