Skip to content

test: distinguish captured trim from live String.prototype.trim - #20

Merged
TomaszJanusz merged 1 commit into
mainfrom
feature/captured-trim-poison-test-9873
Aug 27, 2026
Merged

test: distinguish captured trim from live String.prototype.trim#20
TomaszJanusz merged 1 commit into
mainfrom
feature/captured-trim-poison-test-9873

Conversation

@TomaszJanusz

@TomaszJanusz TomaszJanusz commented Aug 27, 2026

Copy link
Copy Markdown
Member

Summary

The iframe navigation-seed test poisoned String.prototype.trim with a non-empty tracker URL, so both a captured trim and a live value.trim() still parsed the original padded /frame path.

This follow-up makes the stub return "". A live lookup now fails the empty-string check, while the captured native trim still yields example.test.

Follow-up to #19 / CodeRabbit on the trim assertion.

Validation

  • pnpm task lint
  • pnpm task check
  • pnpm task test:unit
  • Both targets still build (pnpm task build:chrome, pnpm task build:firefox)
  • Worker bundle regenerated if packages/refract-core changed
    (pnpm task generate:worker-source)

Focused: pnpm exec vitest run --config config/vitest.config.app.neutral.ts src/injection/main/iframe-navigation-seed.test.ts (4 passed).

Changelog

  • I updated CHANGELOG.md in ## [Unreleased] for user-facing changes.
  • This change does not need a changelog entry (internal/test/CI/refactor only).
Open in Web Open in Cursor 

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

Note

Distinguish captured String.prototype.trim from live method in iframe navigation seed test

Updates the test in iframe-navigation-seed.test.ts so the monkey-patched String.prototype.trim returns an empty string instead of a cross-origin URL. This verifies the function under test uses the captured trim snapshot rather than the live prototype method. The assertion still expects "example.test".

Macroscope summarized 10e9412.

Summary by CodeRabbit

  • Tests
    • Updated coverage for same-origin navigation handling when a destination contains only whitespace.

Poison String.prototype.trim to an empty string so a live value.trim()
lookup fails the seed hostname check instead of still parsing the
original padded URL.

Co-authored-by: Tomasz Janusz <TomaszJanusz@users.noreply.github.com>
@TomaszJanusz
TomaszJanusz marked this pull request as ready for review August 27, 2026 19:07
@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b20b6863-0e58-4616-b86b-ab7a91f978d2

📥 Commits

Reviewing files that changed from the base of the PR and between 62dcb60 and 10e9412.

📒 Files selected for processing (1)
  • src/injection/main/iframe-navigation-seed.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The test now models String.prototype.trim returning an empty string for a whitespace-only destination. It verifies that sameOriginSeedHostname still resolves the destination as same-origin.

Changes

Same-origin seed validation

Layer / File(s) Summary
Whitespace destination trimming
src/injection/main/iframe-navigation-seed.test.ts
The mocked trim method now returns an empty string. The test checks same-origin resolution for a whitespace-only destination.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 10e94

This test-only change makes the iframe navigation-seed test reliably distinguish captured native trimming from a poisoned live trim method without changing production behavior. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description check ✅ Passed The description includes the required Summary, Validation, and Changelog sections. It explains the test change, records the focused test result, and marks the change as internal with no changelog entr…
Title check ✅ Passed The title clearly and concisely describes the main change: distinguishing captured trim behavior from the live String.prototype.trim method in a test.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

Full details: Description check

Explanation

The description includes the required Summary, Validation, and Changelog sections. It explains the test change, records the focused test result, and marks the change as internal with no changelog entry required. The full validation checklist remains unchecked, but this is not critical because the focused test result is documented.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feature/captured-trim-poison-test-9873

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@TomaszJanusz
TomaszJanusz merged commit 92fa5ca into main Aug 27, 2026
42 checks passed
@TomaszJanusz
TomaszJanusz deleted the feature/captured-trim-poison-test-9873 branch August 27, 2026 20:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants