mirror of
https://github.com/openai/codex.git
synced 2026-10-20 17:38:45 +00:00
dennyku
60947e2341
## What changed Fetch optional security setup notices asynchronously for local ChatGPT sessions using the OpenAI provider. Verify that saved credentials match the connected app server, ignore stale account responses, and validate notice text and HTTPS actions on `chatgpt.com`. Show notices as dismissible inline banners with a browser action, while giving applicable usage banners priority. Preserve notice state and dismissal across thread changes, reconnects, and banner replacement for the same account and user. ## Testing Add authenticated HTTP fixture tests, notice validation tests, and TUI tests covering stale responses, dismissal persistence, usage banner priority, browser actions, and wrapping in narrow terminals. GitOrigin-RevId: b8635fcf6a26b42b6a06640601c8517d8d5e47e8
30 lines
1012 B
Rust
30 lines
1012 B
Rust
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
use serde_json::json;
|
|
|
|
#[test]
|
|
fn security_setup_rejects_unsafe_actions_and_terminal_controls() {
|
|
let value = json!({"title":"Keep using Daybreak mode","description":"Set up security.",
|
|
"action":{"label":"Set up security","url":"https://chatgpt.com/cyber"}});
|
|
let notice: Notice = serde_json::from_value(value.clone()).unwrap();
|
|
assert!(notice.valid());
|
|
for url in [
|
|
"http://chatgpt.com/cyber",
|
|
"https://chatgpt.com.evil.test/cyber",
|
|
"https://evil.test/",
|
|
"https://user@chatgpt.com/cyber",
|
|
"https://chatgpt.com:8080/cyber",
|
|
"javascript:alert(1)",
|
|
] {
|
|
let mut invalid = value.clone();
|
|
invalid["action"]["url"] = json!(url);
|
|
assert!(
|
|
!serde_json::from_value::<Notice>(invalid).unwrap().valid(),
|
|
"{url}"
|
|
);
|
|
}
|
|
let mut invalid = notice;
|
|
invalid.title = "untrusted\u{1b}[31m".into();
|
|
assert_eq!(invalid.valid(), false);
|
|
}
|