validStation (Service.qml:199) and consumeState (Service.qml:218) are what bound and validate the contents of headway.json — the file the marketplace security review flagged twice. They enforce the 50-station cap, the per-field type and length checks, and the rejection of malformed entries.
Nothing in tests/ references either function. They are pure logic with no I/O, trapped inside a QML file that node --test cannot load, so the most security-sensitive validation in the plugin is also the only validation with no coverage.
This has a proven fix in this repo. The same problem applied to the state-file shell commands and the curl argv; both were moved into plain modules (State.js, Fetch.js) and are now executed by tests against adversarial inputs. Extracting the validators the same way would let the suite cover:
- more than 50 stations, and exactly 50
- fields at, just under, and just over
stateFieldLimit
- wrong types for
stopId, routes, direction
- prototype-chain keys (
__proto__, constructor) as station ids — Stations.js already has a test for this class, Service.qml does not
- duplicate
stopId values, and an activeStationId naming a station that is not in the list
Two internal review rounds walked past real bugs in the shell commands while they were untested string literals in QML. These validators are in exactly that position now.
validStation(Service.qml:199) andconsumeState(Service.qml:218) are what bound and validate the contents ofheadway.json— the file the marketplace security review flagged twice. They enforce the 50-station cap, the per-field type and length checks, and the rejection of malformed entries.Nothing in
tests/references either function. They are pure logic with no I/O, trapped inside a QML file thatnode --testcannot load, so the most security-sensitive validation in the plugin is also the only validation with no coverage.This has a proven fix in this repo. The same problem applied to the state-file shell commands and the curl argv; both were moved into plain modules (
State.js,Fetch.js) and are now executed by tests against adversarial inputs. Extracting the validators the same way would let the suite cover:stateFieldLimitstopId,routes,direction__proto__,constructor) as station ids —Stations.jsalready has a test for this class,Service.qmldoes notstopIdvalues, and anactiveStationIdnaming a station that is not in the listTwo internal review rounds walked past real bugs in the shell commands while they were untested string literals in QML. These validators are in exactly that position now.