test(setup): hostile-client fixtures against the real setup server (#173)

[rowkav09]

What changed

New test/setup-hostile.test.js. It runs against the real server from startSetupApp, with a media server whose name and version are an XSS payload. It checks what a hostile client could try:

• Cross-site form post (urlencoded, foreign Origin, Sec-Fetch-Site: cross-site) gets 403. A legacy browser with no fetch-metadata sending text/plain gets 415.
• Cross-site fetch with a JSON body from a foreign origin, a look-alike localhost.evil.example, or Origin: null gets 403.
• DNS rebinding: reads and writes with a rebound Host get 421, even when the write carries the real session secret.
• Forged browser headers from a local process (correct Origin and Sec-Fetch-Site, guessed cookie) get 403 without this run's session.
• Framing and script: X-Frame-Options: DENY, frame-ancestors 'none', script-src 'self' with no unsafe-inline/eval or remote hosts, and no inline <script> in the page.
• Injected provider text: discovery returns JSON with nosniff, and the page script has no HTML sinks (innerHTML, insertAdjacentHTML, document.write, eval, new Function). Provider text only goes through textContent.

Why

This is the last checklist item on #173 ("hostile fixtures for DNS rebinding-style Host headers, cross-site forms/fetch, framing and injected provider text"). The other items are done:

• loopback-only binding (fix: harden localhost server boundary #175, fix: reject non-loopback request hosts #179)
• same-origin JSON writes (feat: accept same-origin JSON bodies on the localhost server #195)
• page CSP and framing (feat: opt-in page CSP and 404 fallback on the localhost server #197)
• provider-test rate limit (feat(setup): rate-limit Test connection, test websocket refusal #254)
• per-install session secret (feat(server): optional per-install session secret for state-changing requests (#173) #281, feat(setup): require the session secret on setup writes, native window sends it (#173) #293)

The fixtures run at the HTTP level (what a browser would send), not in a headless browser. Keeping CI browser-free is deliberate.

Checks

• Tests pass locally (full suite green)
• No secrets, tokens, server URLs, or personal media data are committed
• Docs or tests were updated when behavior changed
• The change is scoped to one roadmap issue

Issue

Closes #173

[mira-reviewer-rk]

Mira PR Walkthrough

This PR adds a comprehensive security test suite that validates the setup server's defenses against hostile client attacks. The new test runs against a real server instance with a malicious media server payload, checking protections against cross-site requests, DNS rebinding, forged headers, framing, and script injection.

1 file reviewed

---

Comment @mira-reviewer-rk help to get the list of available commands and usage tips.

[github-actions]

/mira pause

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!