import assert from 'node:assert/strict'; import { JSDOM } from 'jsdom'; const { window } = new JSDOM('', { url: 'http://localhost/' }); globalThis.window = window; const { EnhancedSecureCryptoUtils } = await import('../src/crypto/EnhancedSecureCryptoUtils.js'); window.EnhancedSecureCryptoUtils = EnhancedSecureCryptoUtils; const { EnhancedSecureWebRTCManager } = await import('../src/network/EnhancedSecureWebRTCManager.js'); const P = EnhancedSecureWebRTCManager.prototype; function ctx() { return { _inputValidationLimits: { maxStringLength: 10000, maxObjectDepth: 10, maxArrayLength: 1000, maxMessageSize: 1_000_000 }, _secureLog() {}, _sanitizeInputString: P._sanitizeInputString, _sanitizeInputObject: P._sanitizeInputObject }; } function validate(input) { return P._validateInputData.call(ctx(), input, 'sendSecureMessage'); } // Legitimate plain-text messages that the old keyword blocklist rejected must // now be accepted unchanged. The real XSS boundary is the receive-side // DOMPurify pass, not a guess-the-keyword filter on outgoing content. for (const msg of [ 'the constructor pattern is great', 'global warming is real', 'I will fetch (groceries) later', 'see document.pdf and check window.location', 'javascript: is harmless as plain text', 'discussing