Adversarial video fixture is indexed as text and HLS error triggers byte-CSP assertion #1266

Open
opened 2026-10-07 00:11:05 +00:00 by kayg · 0 comments
Owner

Evidence from adv31 / #1202

Product head 139d4378e, release build and real server. tests/adversarial/attack.py uploads b"not a real video, only an API fixture" as adversarial.mp4 and expects the video source route to return 206, then 416 for malformed ranges. The Index has mime=text/plain, size 37. All five route assertions return 404. This is a safe content classification, not lost source bytes.

hostile_bytes.mjs then calls the same item's HLS master route. Its 404 has a strict default-src 'none' CSP but no sandbox directive. The probe requires sandbox even on the error response, and reports it. No script execution or response >=500 was observed for these cases.

Keep the established fixtures and assertions unchanged. The owner should decide whether these route tests must use a real video and limit the user-byte CSP check to successful byte responses, or whether the product's classification contract should change. This does not show a data-loss or authorization defect. Real-media sandbox/HLS self-tests passed separately. A real video source range regression is still needed for this matrix.

## Evidence from adv31 / #1202 Product head 139d4378e, release build and real server. `tests/adversarial/attack.py` uploads `b"not a real video, only an API fixture"` as `adversarial.mp4` and expects the video source route to return 206, then 416 for malformed ranges. The Index has `mime=text/plain`, size 37. All five route assertions return 404. This is a safe content classification, not lost source bytes. `hostile_bytes.mjs` then calls the same item's HLS master route. Its 404 has a strict `default-src 'none'` CSP but no `sandbox` directive. The probe requires `sandbox` even on the error response, and reports it. No script execution or response >=500 was observed for these cases. Keep the established fixtures and assertions unchanged. The owner should decide whether these route tests must use a real video and limit the user-byte CSP check to successful byte responses, or whether the product's classification contract should change. This does not show a data-loss or authorization defect. Real-media sandbox/HLS self-tests passed separately. A real video source range regression is still needed for this matrix.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1266
No description provided.