safetynet/tests/startup-security.test.mjs

import test from 'node:test';
import assert from 'node:assert/strict';
import { createRequire } from 'node:module';
const require=createRequire(import.meta.url),{assertSecureStartup,BLOCKED_SWITCHES}=require('../apps/browser/startup-security.cjs');
const commandLine=names=>({hasSwitch:name=>new Set(names).has(name)});
test('managed startup rejects sandbox, extension, process-isolation and debugger bypass switches',()=>{
 for(const name of BLOCKED_SWITCHES)assert.throws(()=>assertSecureStartup(commandLine([name]),[]),{message:'Unsafe browser startup configuration'},name);
});
test('managed startup permits normal Electron options and controlled local-agent actions',()=>{
 assert.equal(assertSecureStartup(commandLine(['agent-action','agent-connection','user-data-dir','force-device-scale-factor','disable-gpu','enable-logging','lang']),[]),true);
 assert.equal(assertSecureStartup(commandLine([]),['--trace-warnings','--max-old-space-size=4096']),true);
});
test('Node-consumed inspector flags are rejected without exposing host, port or other values',()=>{
 for(const flag of ['--inspect=private.internal:9229','--inspect-brk=9229','--inspect-wait=0','--inspect-port=company-secret:5555','--debug','--debug-brk']){try{assertSecureStartup(commandLine([]),[flag]);assert.fail('Unsafe inspector flag accepted');}catch(error){assert.equal(error.message,'Unsafe browser startup configuration');assert.equal(error.message.includes(flag),false);}}
});
test('broken command-line adapters fail closed with a static error',()=>{
 for(const adapter of [null,{}, {hasSwitch:()=>undefined},{hasSwitch:()=>{throw Error('private credential value');}}])assert.throws(()=>assertSecureStartup(adapter,[]),{message:'Unsafe browser startup configuration'});
 assert.throws(()=>assertSecureStartup(commandLine([]),null),{message:'Unsafe browser startup configuration'});
 assert.throws(()=>assertSecureStartup(commandLine([]),[{}]),{message:'Unsafe browser startup configuration'});
});
test('an already-active Node inspector is rejected even when no argv flag remains',()=>{
 const inspector=require('node:inspector'),original=inspector.url;try{inspector.url=()=> 'ws://private-main-debugger.internal:9229/secret';assert.throws(()=>assertSecureStartup(commandLine([]),[]),{message:'Unsafe browser startup configuration'});}finally{inspector.url=original;}
});
test('user feature overrides cannot disable native enforcement and never enter errors',()=>{
 for(const flag of ['--disable-features=PrivateFeature','--disable-blink-features=PrivateFeature','--enable-features=PrivateFeature','--enable-blink-features=PrivateFeature','--enable-experimental-web-platform-features','-disable-features=PrivateFeature','/disable-features=PrivateFeature','/DISABLE-FEATURES=PrivateFeature','  --disable-features=PrivateFeature  ','\u0085/disable-features=PrivateFeature\u0085']){
  assert.throws(()=>assertSecureStartup(commandLine([]),[],['browser.exe',flag]),{message:'Unsafe browser startup configuration'});
 }
 assert.equal(assertSecureStartup(commandLine(['disable-features']),[],['browser.exe','--lang=de']),true,'Electron internal defaults are not user overrides');
 assert.throws(()=>assertSecureStartup(commandLine([]),[],[null]),{message:'Unsafe browser startup configuration'});
});