K˽j? d Z ddlmZ ddlZddlmc mZ ddl Z ddl
Z
ddl Z ddl Z ddl
mZ ddlmZmZ ee j j j Zedz dz Zedz d z d
z Zedz d z d z d
z Zd!d"dZ G d de j Z G d de j Z G d de j Z G d d e j Z G d d e j Z e d k r e j! dS dS )#a
Adversarial Stress, Edge-Case & Vulnerability Test Suite for Milestone M2.
Tests:
1. Ring buffer overflow (> 1000 messages added rapidly across 8 channels).
2. Malformed item tags, edge-case rarities, unclosed tags, and ReDoS resistance.
3. XSS and HTML injection vulnerabilities (attribute breakouts, senderName, script tags).
4. Cooldown bypass attempts, rapid channel switching, and Unicode zero-width characters.
5. Headless / SSR safety checks.
) annotationsN)Path)AnyDictclientwebappjsuiz
chat_ui.jsdistchatzChatManager.js .@codestr timeout_secfloatreturnDict[str, Any]c : d| d}t j ddd|gdddt t | }|j d k r t d
|j d |j t |j
d D ]}| }| d
r| d s*| d r+| d rt j | c S i S )z8Helper to run JS code in Node.js and return parsed JSON.z.
(async () => {
try {
z
process.exit(0);
} catch (err) {
console.error(err);
process.exit(1);
}
})();
nodez--input-type=modulez-eTzutf-8)capture_outputtextencodingcwdtimeoutr z Node execution failed (code z):
{}[])
subprocessrunr PROJECT_ROOT
returncode RuntimeErrorstderrreversedstdoutstripsplit
startswithendswithjsonloads)r r wrappedreslines GC:\Projects\FreeExile\tests\unit\test_challenger_m2_chat_adversarial.pyrun_noder2 s8
G . &g6
C ~Z#.ZZcjZZ[[[))++11$7788 $ $zz|| OOC $T]]3%7%7 $T__S=Q=Q $VZVcVcdgVhVh $:d## # # #
I c " e Zd ZdZddZddZdS ) TestRingBufferAdversarialStresszKStress tests the 100-message FIFO ring buffer under rapid flood conditions.r Nonec d}t | }|d }| t | d | D ]\ }}t | }| |d dd| d | |d d | d
d| d | |d d | d
d| d | |d dd dS )zR2,000 rapid messages per channel must never exceed 100 capacity and maintain FIFO.a7
const m = await import('./client/webapp/js/ui/chat_ui.js');
const initialMem = process.memoryUsage().heapUsed;
for (let ch = 1; ch <= 8; ch++) {
for (let i = 1; i <= 2000; i++) {
m.addChatMessage({
messageId: `msg_${ch}_${i}`,
senderName: `Player_${i}`,
channel: ch,
displayContent: `Rapid flood message ${i} on channel ${ch}`,
linkedItems: [],
timestampMs: 1000000 + i
});
}
}
const stats = {};
for (let ch = 1; ch <= 8; ch++) {
const history = m.getChannelHistory(ch);
stats[ch] = {
length: history.length,
oldestId: history[0]?.messageId,
newestId: history[history.length - 1]?.messageId
};
}
const finalMem = process.memoryUsage().heapUsed;
console.log(JSON.stringify({ stats, memDeltaMb: (finalMem - initialMem) / 1024 / 1024 }));
stats lengthd zChannel z exceeded 100 messagesoldestIdmsg__1901z violated FIFO evictionnewestId_2000z missed newest message
memDeltaMbg I@z#Memory delta excessive during floodN)r2 assertEquallenitemsint
assertLess)selfr datar8 ch_strstchs r1 .test_01_chat_ui_ring_buffer_overflow_2000_msgszNTestRingBufferAdversarialStress.test_01_chat_ui_ring_buffer_overflow_2000_msgs< s : ||W
UQ''' ++-- f fJFBVB R\30U20U0U0U V V V R
^-=B-=-=-=?e"?e?e?e f f f R
^-=B-=-=-=?d"?d?d?d e e e e \*D2WXXXXXr3 c d}t | }| D ]a\ }}| |d d | |d d| d | |d d| d bd S )
zRClientChatManager engine must cap at 100 messages FIFO under 2,000 rapid messages.a
const { ClientChatManager, ChatChannel } = await import('./client/dist/chat/ChatManager.js');
const mgr = new ClientChatManager();
for (let ch = 1; ch <= 8; ch++) {
for (let i = 1; i <= 2000; i++) {
mgr.receiveMessage({
messageId: `msg_${ch}_${i}`,
senderName: `User_${i}`,
channel: ch,
displayContent: `Flood content ${i}`,
linkedItems: [],
timestampMs: 1000 + i
});
}
}
const stats = {};
for (let ch = 1; ch <= 8; ch++) {
const list = mgr.getMessagesForChannel(ch);
stats[ch] = {
length: list.length,
oldestId: list[0]?.messageId,
newestId: list[list.length - 1]?.messageId
};
}
console.log(JSON.stringify(stats));
r: r; r< r= r> r? r@ N)r2 rD rB )rG r rH rI rJ s r1 ,test_02_chat_manager_ts_ring_buffer_overflowzLTestRingBufferAdversarialStress.test_02_chat_manager_ts_ring_buffer_overflowe s 8 || **,, C CJFB R\3 / / / R
^-AF-A-A-A B B B R
^-AF-A-A-A B B B B C Cr3 Nr r6 )__name__
__module__ __qualname____doc__rL rN r3 r1 r5 r5 9 sM UU'Y 'Y 'Y 'YR"C "C "C "C "C "Cr3 r5 c " e Zd ZdZddZddZdS ) TestMalformedItemTagsAndReDoSzOChallenges item tag parser and renderer against malformed injections and ReDoS.r r6 c d}t | }|D ]Y}| |d d|d v s |d dk r&| |d dd|d Zd S )
zRMalformed item tags must not crash parser and must not extract corrupt structures.ax
const m = await import('./client/webapp/js/ui/chat_ui.js');
const { ClientChatManager } = await import('./client/dist/chat/ChatManager.js');
const inputs = [
'[item:malformed]',
'[item:::]',
'[item:::::]',
'[item:u1]',
'[item:u1:s1:name:-5]',
'[item:u1:s1:name:abc]',
'[item:u1:s1:name:0]',
'[item:u1:s1:name:999999]',
'[item:u1:s1:name:1.23]',
'[item:!@#$%:^&*():Sword:1]',
'Unclosed [item:u1:s1:Sword:1 and tail',
'Empty [item:]'
];
const results = [];
for (const input of inputs) {
const parsedUI = m.parseItemTags(input);
const parsedTS = ClientChatManager.parseItemTags(input);
const rendered = m.renderMessageHtml(input);
results.push({
input,
parsedCountUI: parsedUI.length,
parsedCountTS: parsedTS.length,
renderedSafe: typeof rendered === 'string'
});
}
console.log(JSON.stringify(results));
renderedSafe malformedinputz [item:::]
parsedCountUIr z Should not parse invalid tag: N)r2
assertTruerB )rG r rH r/ s r1 &test_03_malformed_item_tags_resiliencezDTestMalformedItemTagsAndReDoS.test_03_malformed_item_tags_resilience s B || k kC OOC / 0 0 0c'l**c'lk.I.I _!5q:i[^_f[g:i:ijjj k kr3 c j d}t | }|D ] }| |dd|dd dS )zXRegex parser must evaluate 100,000-character adversarial inputs in < 20ms without ReDoS.a
const m = await import('./client/webapp/js/ui/chat_ui.js');
const adversarialStrings = [
'[item:' + 'a'.repeat(100000),
'[item:uuid:' + 'b'.repeat(100000),
'[item:uuid:sig:' + 'c'.repeat(100000),
'[item:uuid:sig:name:' + '9'.repeat(100000),
'[item:'.repeat(20000)
];
const timings = [];
for (const str of adversarialStrings) {
const t0 = performance.now();
m.parseItemTags(str);
m.renderMessageHtml(str);
const t1 = performance.now();
timings.push(t1 - t0);
}
console.log(JSON.stringify(timings));
g 9@z Regex evaluation took too long: z.2fzms (potential ReDoS)N)r2 rF )rG r timingsts r1 *test_04_regex_redos_adversarial_resistancezHTestMalformedItemTagsAndReDoS.test_04_regex_redos_adversarial_resistance s[ ( 2,, e eA OOAt%c%c%c%c%c d d d d e er3 NrO )rP rQ rR rS r] ra rT r3 r1 rV rV sM YY'k 'k 'k 'kRe e e e e er3 rV c * e Zd ZdZddZddZddZdS ) &TestXssAndHtmlInjectionVulnerabilitieszKAdversarially tests for cross-site scripting (XSS) and attribute breakouts.r r6 c d}t | }| |d | |d | |d | |d dS )zHStandard HTML tags in message text must be escaped by renderMessageHtml.a
const m = await import('./client/webapp/js/ui/chat_ui.js');
const raw = 'bold
';
const rendered = m.renderMessageHtml(raw);
console.log(JSON.stringify({
hasRawScript: rendered.includes('