Harden Windows DLP enforcement and Electron runtime packaging

tests/proxy-credentials.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+const {deploymentProxyCredentials}=createRequire(import.meta.url)('../apps/browser/proxy-credentials.cjs');
+test('deployment proxy credentials require an exact host and port pin',()=>{
+ const env={SAFETYNET_PROXY_USER:'fixture-user',SAFETYNET_PROXY_PASSWORD:'fixture-password',SAFETYNET_PROXY_AUTH_HOST:'proxy.company.example',SAFETYNET_PROXY_AUTH_PORT:'8443'};
+ assert.deepEqual(deploymentProxyCredentials({host:'PROXY.COMPANY.EXAMPLE',port:8443},env),{username:'fixture-user',password:'fixture-password'});
+ for(const selected of [{host:'attacker.example',port:8443},{host:'proxy.company.example',port:8080}])assert.equal(deploymentProxyCredentials(selected,env),null);
+ assert.equal(deploymentProxyCredentials({host:'proxy.company.example',port:8443},{...env,SAFETYNET_PROXY_AUTH_HOST:undefined}),null);
+});