magdevandClaude Opus 5.5
4248bc791a
PDF.js's signature dialog saved every signature in localStorage under pdfjs.signature, "save" ticked on every open, for this origin rather than for a bau-pm user. Measured on v0.1.0: a typed and an uploaded signature were offered to a fresh page on the same browser, the way the next person on a shared tablet would get it, a Redmine logout included. Another browser profile saw nothing; the server never had anything. The glue's fifth duty, in every window before PDF.js's modules: delete the store (a device that saved signatures loses them on its first visit), refuse writes to that key, hold the save box unticked through a property on the element and hide it, and hide the dialog's Bild tab and its file picker, so a scanned signature never enters the dialog. test/signatures.mjs is the second gate, in CI and the release workflow: a browser seeded with a real saved entry (captured from v0.1.0's own store) is offered none, the dialog shows neither the box nor the tab, a typed signature is placed and not stored, a fresh page is offered nothing. Fed v0.1.0: 9 findings, exit 1. Against this image: 0, and the zero-host gate drove 117 tool pages with nothing leaving the origin. A signed PDF still exports with the signature on the page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 lines
650 B
Docker
14 lines
650 B
Docker
# The gates' own image (test/zero-hosts.mjs, test/signatures.mjs): Chromium and playwright-core,
|
|
# with the test files and the glue baked in, because the CI runner passes the
|
|
# host's Docker socket through and a mounted workspace would be empty.
|
|
FROM public.ecr.aws/docker/library/node:20-alpine
|
|
RUN apk add --no-cache chromium
|
|
WORKDIR /gate
|
|
RUN npm init -y >/dev/null && npm install --no-audit --no-fund --silent playwright-core@1.63.0
|
|
COPY test/ ./test/
|
|
COPY glue/ ./glue/
|
|
RUN node --check glue/handoff.js
|
|
ENV PLAYWRIGHT_CORE=/gate/node_modules/playwright-core/index.mjs \
|
|
CHROMIUM=/usr/bin/chromium-browser
|
|
CMD ["node", "test/zero-hosts.mjs"]
|