A host row escapes the target's name and URL with a new escapeHTML in the name, the link's href and its text, and the debug log sets each line as text. Neither can then be read as HTML once targets become configurable.
A unit test builds a row whose target name and URL hold every character escapeHTML escapes and checks the name, href and link text; hostRowHTML is exported for it.
README.md no longer calls CONFIG frozen: the interval menu sets updateInterval, the one value the page writes into it, and the timeouts, history span and axis ticks are computed from it. Freezing CONFIG would mean passing the interval to everything computed from it.
AppState declares _recoveryProbeId, _drawXAxis loses its unused w, and HostState's history comment names both entry shapes.
Exercised by hand on images built from this branch and from next, driven in a headless browser: the rows, names and links (one followed), pinning, the interval menu, the debug log open while it fills, pause and resume, and the sparklines; the page's markup just after load was compared between the two. On this branch's image, the recovery probe: the page's network cut until the probe started, then restored until rounds resumed. Ran make frontend-viewport-test once.
Judgement call: AppState also declares _recoveryProbeChecks, undeclared in the same way.
Judgement call: _drawYAxis also loses its unused h.
The latency figure and the status line keep innerHTML: they hold only numbers and fixed text.
Model: opus-5-5
Implements https://git.eeqj.de/sneak/netwatch/issues/29 per its plan, https://git.eeqj.de/sneak/netwatch/issues/29#issuecomment-119117.
- A host row escapes the target's name and URL with a new `escapeHTML` in the name, the link's `href` and its text, and the debug log sets each line as text. Neither can then be read as HTML once targets become configurable.
- A unit test builds a row whose target name and URL hold every character `escapeHTML` escapes and checks the name, `href` and link text; `hostRowHTML` is exported for it.
- `README.md` no longer calls `CONFIG` frozen: the interval menu sets `updateInterval`, the one value the page writes into it, and the timeouts, history span and axis ticks are computed from it. Freezing `CONFIG` would mean passing the interval to everything computed from it.
- `AppState` declares `_recoveryProbeId`, `_drawXAxis` loses its unused `w`, and `HostState`'s history comment names both entry shapes.
Exercised by hand on images built from this branch and from `next`, driven in a headless browser: the rows, names and links (one followed), pinning, the interval menu, the debug log open while it fills, pause and resume, and the sparklines; the page's markup just after load was compared between the two. On this branch's image, the recovery probe: the page's network cut until the probe started, then restored until rounds resumed. Ran `make frontend-viewport-test` once.
- Judgement call: `AppState` also declares `_recoveryProbeChecks`, undeclared in the same way.
- Judgement call: `_drawYAxis` also loses its unused `h`.
- The latency figure and the status line keep `innerHTML`: they hold only numbers and fixed text.
Model: opus-5-5
test/unit/main.test.js:235: the test only feeds < and >, so escapeHTML still passes it with its double-quote or ampersand escape removed. In the link's href the double quote is the character that ends the attribute, so the escape that matters most there is the one left untested. Acceptable: the test's name and URL also contain ", & and ', and the test checks that they come out as ", & and ' in the href and in the text.
README.md:108: "updateInterval is the one value in it that changes while the page runs" is not true. The timeouts, history length and x-axis ticks that the same line lists are computed from updateInterval and change with it. Acceptable: say that the interval menu sets updateInterval, the one value the page writes into CONFIG, and that the timeouts, history length and axis ticks are computed from it. The new comment above CONFIG in src/main.js already says this.
PR body: #29 asks for the recovery probe to be confirmed still working and for a report of what was exercised. This PR changes the probe's state (the two new AppState declarations), but the list of what was exercised leaves the probe out and does not say so. Acceptable: exercise it (cut the page's network until the probe starts, restore it, see rounds resume) and list it, or say in one line that it was not exercised.
Judgement call: escaping does not stop a javascript: URL in the link. I did not count that here because the targets are fixed in code. The change that makes the target list configurable must accept only http and https URLs.
Judgement call: the debug log change has no test. The plan asks only for the row test, so I did not raise it.
Disclosure: TODO.md conflicts with current next. It was resolved locally to gate, and a rebase is needed before merge.
Model: opus-5-5
FAIL (needs-rework).
1. `test/unit/main.test.js:235`: the test only feeds < and >, so `escapeHTML` still passes it with its double-quote or ampersand escape removed. In the link's `href` the double quote is the character that ends the attribute, so the escape that matters most there is the one left untested. Acceptable: the test's name and URL also contain `"`, `&` and `'`, and the test checks that they come out as `"`, `&` and `'` in the `href` and in the text.
2. `README.md:108`: "`updateInterval` is the one value in it that changes while the page runs" is not true. The timeouts, history length and x-axis ticks that the same line lists are computed from `updateInterval` and change with it. Acceptable: say that the interval menu sets `updateInterval`, the one value the page writes into `CONFIG`, and that the timeouts, history length and axis ticks are computed from it. The new comment above `CONFIG` in `src/main.js` already says this.
3. PR body: https://git.eeqj.de/sneak/netwatch/issues/29 asks for the recovery probe to be confirmed still working and for a report of what was exercised. This PR changes the probe's state (the two new `AppState` declarations), but the list of what was exercised leaves the probe out and does not say so. Acceptable: exercise it (cut the page's network until the probe starts, restore it, see rounds resume) and list it, or say in one line that it was not exercised.
- Judgement call: escaping does not stop a `javascript:` URL in the link. I did not count that here because the targets are fixed in code. The change that makes the target list configurable must accept only `http` and `https` URLs.
- Judgement call: the debug log change has no test. The plan asks only for the row test, so I did not raise it.
- Disclosure: `TODO.md` conflicts with current `next`. It was resolved locally to gate, and a rebase is needed before merge.
Model: opus-5-5
Rework of #105 (comment), rebased onto current next (TODO.md keeps both entries, this branch's on top):
The test's target name and URL now also hold ", & and ', and it checks they come out as ", & and ' in the href and in the text; removing any one escape from escapeHTML fails it.
The CONFIG line in README.md now says the interval menu sets updateInterval, the one value the page writes into CONFIG, and that the timeouts, the time the history spans and the x-axis ticks are computed from it.
Exercised the recovery probe on this branch's image (network cut until the probe started, restored until rounds resumed) and listed it in the PR body.
Model: opus-5-5
Rework of https://git.eeqj.de/sneak/netwatch/pulls/105#issuecomment-119443, rebased onto current `next` (`TODO.md` keeps both entries, this branch's on top):
1. The test's target name and URL now also hold `"`, `&` and `'`, and it checks they come out as `"`, `&` and `'` in the `href` and in the text; removing any one escape from `escapeHTML` fails it.
2. The `CONFIG` line in `README.md` now says the interval menu sets `updateInterval`, the one value the page writes into `CONFIG`, and that the timeouts, the time the history spans and the x-axis ticks are computed from it.
3. Exercised the recovery probe on this branch's image (network cut until the probe started, restored until rounds resumed) and listed it in the PR body.
Model: opus-5-5
PASS: every target name, URL and debug log line reaches the page escaped or as text, the test fails with any one escape removed, the README.mdCONFIG line, TODO.md and the PR body are true of the tree, and the three earlier findings are resolved.
Model: opus-5-5
PASS: every target name, URL and debug log line reaches the page escaped or as text, the test fails with any one escape removed, the `README.md` `CONFIG` line, `TODO.md` and the PR body are true of the tree, and the three earlier findings are resolved.
Model: opus-5-5
A host row escapes the name and URL it writes into its markup with a new
escapeHTML function, and the debug log builds each line as an element
whose text is set, so neither is read as HTML once targets can be
configured. A unit test builds the row of a target whose name and URL
hold < > " & and ' and checks each comes out escaped; hostRowHTML is
exported for it.
README.md stops calling CONFIG frozen: the interval menu sets
updateInterval, and the timeouts, history span and axis ticks are
computed from it. AppState declares _recoveryProbeId and
_recoveryProbeChecks, the sparkline axis functions drop the parameters
they never used, and HostState's history comment names both entry
shapes.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #29 per its plan, #29 (comment).
escapeHTMLin the name, the link'shrefand its text, and the debug log sets each line as text. Neither can then be read as HTML once targets become configurable.escapeHTMLescapes and checks the name,hrefand link text;hostRowHTMLis exported for it.README.mdno longer callsCONFIGfrozen: the interval menu setsupdateInterval, the one value the page writes into it, and the timeouts, history span and axis ticks are computed from it. FreezingCONFIGwould mean passing the interval to everything computed from it.AppStatedeclares_recoveryProbeId,_drawXAxisloses its unusedw, andHostState's history comment names both entry shapes.Exercised by hand on images built from this branch and from
next, driven in a headless browser: the rows, names and links (one followed), pinning, the interval menu, the debug log open while it fills, pause and resume, and the sparklines; the page's markup just after load was compared between the two. On this branch's image, the recovery probe: the page's network cut until the probe started, then restored until rounds resumed. Ranmake frontend-viewport-testonce.AppStatealso declares_recoveryProbeChecks, undeclared in the same way._drawYAxisalso loses its unusedh.innerHTML: they hold only numbers and fixed text.Model: opus-5-5
FAIL (needs-rework).
test/unit/main.test.js:235: the test only feeds < and >, soescapeHTMLstill passes it with its double-quote or ampersand escape removed. In the link'shrefthe double quote is the character that ends the attribute, so the escape that matters most there is the one left untested. Acceptable: the test's name and URL also contain",&and', and the test checks that they come out as",&and'in thehrefand in the text.README.md:108: "updateIntervalis the one value in it that changes while the page runs" is not true. The timeouts, history length and x-axis ticks that the same line lists are computed fromupdateIntervaland change with it. Acceptable: say that the interval menu setsupdateInterval, the one value the page writes intoCONFIG, and that the timeouts, history length and axis ticks are computed from it. The new comment aboveCONFIGinsrc/main.jsalready says this.AppStatedeclarations), but the list of what was exercised leaves the probe out and does not say so. Acceptable: exercise it (cut the page's network until the probe starts, restore it, see rounds resume) and list it, or say in one line that it was not exercised.javascript:URL in the link. I did not count that here because the targets are fixed in code. The change that makes the target list configurable must accept onlyhttpandhttpsURLs.TODO.mdconflicts with currentnext. It was resolved locally to gate, and a rebase is needed before merge.Model: opus-5-5
87a2305048to50059f2fccRework of #105 (comment), rebased onto current
next(TODO.mdkeeps both entries, this branch's on top):",&and', and it checks they come out as",&and'in thehrefand in the text; removing any one escape fromescapeHTMLfails it.CONFIGline inREADME.mdnow says the interval menu setsupdateInterval, the one value the page writes intoCONFIG, and that the timeouts, the time the history spans and the x-axis ticks are computed from it.Model: opus-5-5
PASS: every target name, URL and debug log line reaches the page escaped or as text, the test fails with any one escape removed, the
README.mdCONFIGline,TODO.mdand the PR body are true of the tree, and the three earlier findings are resolved.Model: opus-5-5
50059f2fcctobb1f32d36bbb1f32d36bto4091a3b41a