morgan/editor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(mcp): fix residual stale-number references in PR description

Browse Source 
Two lines still cited the pre-A2 state (294 tests / 40 files,
"known gaps remain at save_scene / POST boundary"). Corrected
against the actual 302/41 and the Phase 10 A2 closure of those
boundaries via the shared apiGraphSchema.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Adrian Perez
2026-04-19 21:03:44 +02:00
co-authored by Claude Opus 4.7
parent 7ed34f5b4f
commit 06d00566f0
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/mcp/test-reports/pre-push/a5-pr-description.md
+3 -3
View File
@@ -79,7 +79,7 @@ Added `./schema`, `./store`, `./material-library`, `./spatial-grid`, `./wall` en
Introduces a shared `AssetUrl` Zod validator replacing bare `z.string()` on every URL field in core's schemas (`scan.url`, `guide.url`, `item.asset.src`, `material.texture.url`, all material map fields). Rejects `javascript:`, `file:`, `ftp:`, `data:text/html`, foreign `http:`, `vbscript:`, and similar. Accepts `asset://`, `blob:`, `data:image/`, `/` (app-relative), `https:`, and `http://localhost` for dev. Optional per-origin narrowing via `PASCAL_ALLOWED_ASSET_ORIGINS`. Introduces a shared `AssetUrl` Zod validator replacing bare `z.string()` on every URL field in core's schemas (`scan.url`, `guide.url`, `item.asset.src`, `material.texture.url`, all material map fields). Rejects `javascript:`, `file:`, `ftp:`, `data:text/html`, foreign `http:`, `vbscript:`, and similar. Accepts `asset://`, `blob:`, `data:image/`, `/` (app-relative), `https:`, and `http://localhost` for dev. Optional per-origin narrowing via `PASCAL_ALLOWED_ASSET_ORIGINS`.
This closes the security finding from the Phase 3 audit: a crafted scene with `javascript:alert(1)` for a texture URL would have beaconed or exfiltrated when rendered. Known gaps remain at the `save_scene` / `POST /api/scenes` boundary (see Security notes). This closes the security finding from the Phase 3 audit: a crafted scene with `javascript:alert(1)` for a texture URL would have beaconed or exfiltrated when rendered. Phase 10 A2 further extended the validator to the `save_scene(includeCurrentScene: false)`, `POST /api/scenes`, and `PUT /api/scenes/[id]` boundaries via a shared `apiGraphSchema` (see Security notes).
#### `apps/editor` — persistence routes + scene page (CROSS_CUTTING §4) #### `apps/editor` — persistence routes + scene page (CROSS_CUTTING §4)
@@ -103,7 +103,7 @@ bun install
bun run --cwd packages/core build bun run --cwd packages/core build
bun run --cwd packages/mcp build bun run --cwd packages/mcp build
# Unit + integration tests (294 tests, 40 files) # Unit + integration tests (302 tests, 41 files)
bun test --cwd packages/mcp bun test --cwd packages/mcp
# Biome lint # Biome lint
@@ -126,7 +126,7 @@ bun packages/mcp/test-reports/phase8/p10-full-sweep.ts
| Evidence | Result | | Evidence | Result |
|---|---| |---|---|
| `bun test --cwd packages/mcp` | **302/302 pass** across 40 test files | | `bun test --cwd packages/mcp` | **302/302 pass** across 41 test files |
| Biome check | 0 errors (73 source files checked) | | Biome check | 0 errors (73 source files checked) |
| TypeScript build | `tsc` clean, strict mode, no `any` without documented reason | | TypeScript build | `tsc` clean, strict mode, no `any` without documented reason |
| T1 stdio smoke | 21/21 tools PASS, 106 ms | | T1 stdio smoke | 21/21 tools PASS, 106 ms |