Aug 26 - Enhance security 3

.gitea/workflows/ci.yml

@@ -8,7 +8,7 @@
 #   lint-python      — flake8 style + error check
 #   syntax-check     — ast.parse all Python files
 #   migration-check  — verify Alembic chain has single head
-#   js-syntax        — node syntax check on all JS files
+#   js-syntax        — node syntax check on all JS files + PSL matching tests
 #   tests            — pytest suite (in-memory SQLite, no MySQL needed)
 #   build-extension  — zip Chrome and Firefox extensions
 
@@ -132,7 +132,7 @@ jobs:
             extension/background.firefox.js \
             extension/content/content.js \
             extension/bridge/bridge.js \
-            extension/shared/crypto.js; do
+            extension/shared/crypto.js \n            extension/shared/psl.js; do
             if [ -f "$f" ]; then
               node -e "new Function(require('fs').readFileSync('$f','utf8'))" 2>/dev/null || \
               { echo "FAIL: $f"; FAILED=1; }
@@ -141,6 +141,11 @@ jobs:
           [ $FAILED -eq 0 ] && echo "OK: all JS files parsed cleanly"
           exit $FAILED
 
+      - name: PSL matching tests
+        # Guards the autofill same-site check. A wrong answer here means
+        # credentials offered on an attacker's neighbouring subdomain.
+        run: node tests/js/test_psl.js
+
   # ── Test suite ───────────────────────────────────────────────────────────────
   # Runs against in-memory SQLite (see app/config.py TestingConfig) so no MySQL
   # service is needed on the host-mode runner. That means these tests cover