test(xss): lazy-load Playwright for unittest and assert DOMPurify.sanitize runs

Author: clean6378-max-it

tests/test_xss_browser.py

@@ -19,14 +19,16 @@
 from __future__ import annotations
 
 import threading
-from typing import Any, Generator
+from typing import TYPE_CHECKING, Any, Generator
 
 import pytest
-from playwright.sync_api import Page, sync_playwright
 from werkzeug.serving import make_server
 
 from app import create_app
 
+if TYPE_CHECKING:
+    from playwright.sync_api import Page
+
 # Representative vectors from the sprint issue.
 XSS_VECTORS: list[tuple[str, str]] = [
     ("img_onerror", '<img src=x onerror="window.__xssProbe=1">'),
@@ -50,27 +52,46 @@
   const el = document.createElement('div');
   el.id = 'xss-browser-test-host';
   document.body.appendChild(el);
+  let sanitizeCalls = 0;
+  let restoreSanitize = null;
   if (useSafeRender) {{
-    if (typeof renderMarkdownSafe !== 'function') {{
-      throw new Error('renderMarkdownSafe is not defined — is app.js loaded?');
-    }}
-    el.innerHTML = renderMarkdownSafe(payload);
-  }} else {{
-    const html = marked.parse(payload, {{ breaks: true, gfm: true }});
-    el.innerHTML = html;
+    const originalSanitize = DOMPurify.sanitize.bind(DOMPurify);
+    DOMPurify.sanitize = (...args) => {{
+      sanitizeCalls += 1;
+      return originalSanitize(...args);
+    }};
+    restoreSanitize = () => {{
+      DOMPurify.sanitize = originalSanitize;
+    }};
   }}
-  await new Promise((resolve) => setTimeout(resolve, {_PROBE_SETTLE_MS}));
-  const result = {{
-    probe: window.__xssProbe || 0,
-    onerrorAttr: el.querySelector('[onerror]') !== null,
-    scriptTag: el.querySelector('script') !== null,
-    jsHref: el.querySelector('[href^="javascript:"]') !== null,
-    svgOnload: el.querySelector('svg[onload]') !== null,
-  }};
-  if (!useSafeRender) {{
-    result.html = el.innerHTML;
+  try {{
+    if (useSafeRender) {{
+      if (typeof renderMarkdownSafe !== 'function') {{
+        throw new Error('renderMarkdownSafe is not defined — is app.js loaded?');
+      }}
+      el.innerHTML = renderMarkdownSafe(payload);
+    }} else {{
+      const html = marked.parse(payload, {{ breaks: true, gfm: true }});
+      el.innerHTML = html;
+    }}
+    await new Promise((resolve) => setTimeout(resolve, {_PROBE_SETTLE_MS}));
+    const result = {{
+      probe: window.__xssProbe || 0,
+      onerrorAttr: el.querySelector('[onerror]') !== null,
+      scriptTag: el.querySelector('script') !== null,
+      jsHref: el.querySelector('[href^="javascript:"]') !== null,
+      svgOnload: el.querySelector('svg[onload]') !== null,
+      sanitizeCalls: useSafeRender ? sanitizeCalls : 0,
+    }};
+    if (!useSafeRender) {{
+      result.html = el.innerHTML;
+    }}
+    return result;
+  }} finally {{
+    if (restoreSanitize) {{
+      restoreSanitize();
+    }}
   }}
-  return result;
 }}
 """
 
@@ -92,18 +113,25 @@ def _assert_sink_neutralized(result: dict[str, Any], vector_name: str) -> None:
     assert not result["svgOnload"], (
         f"svg onload survived sanitization for {vector_name!r}"
     )
+    assert result.get("sanitizeCalls", 0) >= 1, (
+        f"DOMPurify.sanitize was not called for {vector_name!r}; "
+        "renderMarkdownSafe must not take the escapeHtml-only path for these payloads"
+    )
 
 
 @pytest.fixture(scope="module")
 def playwright_browser():
+    pytest.importorskip("playwright")
+    from playwright.sync_api import sync_playwright
+
     with sync_playwright() as playwright:
         browser = playwright.chromium.launch(headless=True)
         yield browser
         browser.close()
 
 
 @pytest.fixture
-def browser_page(playwright_browser) -> Generator[Page, None, None]:
+def browser_page(playwright_browser) -> Generator["Page", None, None]:
     page = playwright_browser.new_page()
     try:
         yield page
@@ -127,7 +155,7 @@ def live_server_url(workspace_storage: str) -> Generator[str, None, None]:
 
 
 @pytest.fixture
-def app_page(browser_page: Page, live_server_url: str) -> Page:
+def app_page(browser_page: "Page", live_server_url: str) -> "Page":
     """Any HTML page that loads base.html scripts (marked, DOMPurify, app.js)."""
     response = browser_page.goto(f"{live_server_url}/", wait_until="networkidle")
     assert response is not None and response.ok
@@ -140,7 +168,7 @@ def app_page(browser_page: Page, live_server_url: str) -> Page:
 @pytest.mark.browser
 @pytest.mark.parametrize("vector_name,payload", XSS_VECTORS, ids=[v[0] for v in XSS_VECTORS])
 def test_render_markdown_safe_neutralizes_xss_vector(
-    app_page: Page, vector_name: str, payload: str
+    app_page: "Page", vector_name: str, payload: str
 ) -> None:
     result = app_page.evaluate(
         _INSPECT_XSS_SINK, {"payload": payload, "useSafeRender": True}
@@ -150,7 +178,7 @@ def test_render_markdown_safe_neutralizes_xss_vector(
 
 @pytest.mark.browser
 def test_bare_marked_parse_leaves_dangerous_markup_negative_control(
-    app_page: Page,
+    app_page: "Page",
 ) -> None:
     """Without DOMPurify.sanitize, marked output still carries exploitable markup."""
     payload = XSS_VECTORS[0][1]