The cross-app message injection test at security.spec.ts:313 has been a
no-op since it was added in 2411c71a. It attempted to reach the inner app
iframe via:
outerIframe.contentDocument?.querySelector('iframe')
but contentDocument is null across the 8080→8081 origin boundary (the test
at :247 in the same file explicitly asserts this). The ?. short-circuited,
postMessage never fired, and the test passed without exercising the
defense in message-transport.ts.
Fix:
- Use window.frames[0].frames[0] — cross-origin accessible per HTML spec,
and the actual attack path a malicious sibling app would use
- Return a sentinel from page.evaluate() and assert it, so the test fails
loudly if frame traversal ever breaks again
- Actually assert the rejection log (was previously captured but never
checked)
- Use expect.poll() instead of waitForTimeout(500)
- Reuse captureConsoleLogs helper
Also fixed: comment at :293 claimed 'Outer frame should NOT have
allow-same-origin' but the assertion checks allow-top-navigation. The
outer frame DOES have allow-same-origin (implementation.ts:167);
isolation comes from the separate port, not the sandbox attribute.
