4.1 KiB
FAIL
crates/ely-web-content/src/handlers.rs:317 — The content boundary covers navigation only; subresource requests bypass it. In the real-window probe, a page under its permitted root loaded a script from the sibling outside directory and reported {"externalCode":"outside-code-ran"} through elyQuery. An image also reached the local HTTP server at /pixel?text=REVIEW_SENTINEL. This breaks PRD §17.3's bundled-code and restricted-resource contract. Apply resource authorization before subresource requests and redirects, covering scripts, images and other resource types; enforce the permitted file identities and deny unauthorized network destinations.
crates/ely-web-content/src/view.rs:81 — The folder check compares lexical paths and follows symlinks during the eventual load. Create root/link pointing to a sibling outside directory, then navigate the loaded page to file:///.../root/link/outside.html. The real CEF page loads and executes the outside script, reporting {"outside":true,"href":"file:///.../root/link/outside.html"}. This contradicts the C14.0 claim that pages cannot leave their content folder. Resolve the target's filesystem identity and verify containment in the canonical root before allowing navigation or resources.
crates/ely-web-content/src/handlers.rs:301 — Closing a browser removes the registry entry while leaving Surface.browser populated. Surface owns Browser, Browser retains its client handlers, and those handlers own Surface, producing a reference cycle. A real-window open/close probe tracked surfaces with Weak references: after closing 20 views it reported release: dropped=20 alive=20. Clearing the stored browser reference in the copy's close callback changed the same result to alive=0. This violates PERF-08. Break the browser/surface ownership cycle during completed browser closure and add a regression that verifies release after repeated closes.
crates/ely-web-content/src/handlers.rs:275 — Load failures have no error callback handling, and on_load_end unconditionally produces Event::Loaded. Delete the page after WebView::open validates it and before the asynchronous browser loads it: the probe reports Loaded, with location chrome-error://chromewebdata/ and body Your file couldn’t be accessed ... ERR_FILE_NOT_FOUND; no application failure event is emitted. Chromium's default error UI consequently occupies the content area. Handle load errors explicitly, report failure to the owner, and display the error through GPUI; emit Loaded only for a successful content load.
crates/ely-web-content/src/view.rs:155 — File URLs are assembled from raw path text, so legal filename characters are interpreted as URL syntax. Opening an existing name#part.html succeeds at the host API and then loads Chromium's ERR_FILE_NOT_FOUND page because the suffix becomes a fragment. The real-window probe confirmed this with the existing file still present. Construct a properly escaped file URL from the filesystem path and test reserved characters in both content directories and page filenames.
apps/ely-mark/src/main.rs:36 — CEF initialization and renderer failures are handled solely by logging. In the independently built .app, terminating its renderer processes emits mark: the page crashed: TerminationStatus(TS_PROCESS_WAS_KILLED) (9), while the window continues displaying the previous editor image with no visible fault or reopening action. Screenshots before and after termination confirm the unchanged content. This breaks the visible-failure contract in PRD §6.3. Handle Event::Crashed by updating the application UI to a fault state and providing a reopening path, including failures from asynchronous initialization.
tests/scripts/webview.sh:21 — The live-window gate checks page-reported strings without checking the rendered output. In the isolated copy, replacing WebView's window.paint_image call with a successful no-op removed all page painting; the unchanged script still exited successfully with ok: webview. The core C14.0 rendering regression therefore escapes the acceptance gate. Add an assertion on actual window pixels that fails when the page is absent, and prove it with the same removed-paint mutation.