3 lines
1.9 KiB
JavaScript
3 lines
1.9 KiB
JavaScript
import fs from 'node:fs';import vm from 'node:vm';import assert from 'node:assert/strict';
|
|
const root='C:/laragon/data/sgf-tempo/run/modular-regression-2576427d1939/private/ledger-6070063f42f2',out=root+'/financial-receipt-form.json';if(fs.existsSync(out))throw Error('Preserved proof');const scripts=[...fs.readFileSync(root+'/financial-receipt-page.html','utf8').matchAll(/<script>([\s\S]*?)<\/script>/g)].map(x=>x[1]);for(const s of scripts)new vm.Script(s);let checks=0;const ok=(v,m)=>{checks++;assert(v,m);},form={elements:{domain:{value:'ledger'},command_key:{value:'11111111-1111-1111-1111-111111111111'}},querySelector:()=>button},button={},status={},result={set innerHTML(v){throw Error('Must never insert HTML');}},calls=[];let fail=false;const ctx={document:{getElementById:id=>({'receipt-lookup':form,'receipt-status':status,'receipt-result':result}[id])},fetch:async(url,options)=>{calls.push({url,options});return {ok:!fail,json:async()=>fail?{message:'Refused'}:{result:'<img src=x onerror=unsafe()>'}};}};vm.createContext(ctx);vm.runInContext(scripts.find(s=>s.includes('receipt-lookup')),ctx);for(const domain of ['ledger','recognition','settlement']){form.elements.domain.value=domain;await form.onsubmit({preventDefault(){}});const c=calls.at(-1);ok(c.url.includes(domain==='ledger'?'/receipts/':'/financial-receipts/'+domain+'/')&&!c.options.method&&!c.options.body,'Explicit domain GET only '+domain);}ok(result.textContent.includes('<img')&&!button.disabled,'Result remains text, no executable HTML');fail=true;await form.onsubmit({preventDefault(){}});ok(status.textContent.includes('Refused')&&result.textContent===''&&!button.disabled&&calls.length===4,'Refusal clears result and never auto-replays');fs.writeFileSync(out,JSON.stringify({passed:true,checks,rendered_scripts_compile:true,mock_get_only:true,no_browser:true},null,2));console.log(JSON.stringify({passed:true,checks}));
|