fix(oauth2): prevent code injection in OAuth2 callback handling #1162
tests-linux.yml
on: pull_request
Unit Tests (Linux)
6m 10s
CLI Tests (Linux)
3m 32s
Playwright E2E Tests (Linux)
57m 56s
SSL Tests (Linux)
5m 6s
OAuth 1.0 Auth Tests (Linux)
5m 48s
Annotations
7 errors, 5 warnings, and 2 notices
|
OAuth 1.0 Auth Tests (Linux)
Process completed with exit code 1.
|
|
[system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC):
tests/proxy/system-pac/system-pac-proxy.spec.ts#L0
4) [system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC)
Retry #1 ───────────────────────────────────────────────────────────────────────────────────────
Error: listen EADDRINUSE: address already in use 127.0.0.1:18080
|
|
[system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC):
tests/proxy/system-pac/system-pac-proxy.spec.ts#L0
4) [system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC)
Error: listen EADDRINUSE: address already in use 127.0.0.1:18080
|
|
[default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully:
tests/import/postman/import-oauth2-implicit-grant-type.spec.ts#L35
3) [default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully › Open import collection modal
TimeoutError: locator.click: Timeout 30000ms exceeded.
Call log:
- waiting for getByTestId('collections-header-add-menu')
- locator resolved to <button tabindex="-1" aria-expanded="false" data-tabindex="inline" title="Add new collection" data-testid="collections-header-add-menu" class="StyledWrapper-iYvzMB btWNSr action-icon">…</button>
- attempting click action
2 × waiting for element to be visible, enabled and stable
- element is visible, enabled and stable
- scrolling into view if needed
- done scrolling
- <div class="bruno-modal-backdrop"></div> from <div class="StyledWrapper__Wrapper-jjqtyM DwvBf">…</div> subtree intercepts pointer events
- retrying click action
- waiting 20ms
2 × waiting for element to be visible, enabled and stable
- element is visible, enabled and stable
- scrolling into view if needed
- done scrolling
- <div class="bruno-modal-backdrop"></div> from <div class="StyledWrapper__Wrapper-jjqtyM DwvBf">…</div> subtree intercepts pointer events
- retrying click action
- waiting 100ms
58 × waiting for element to be visible, enabled and stable
- element is visible, enabled and stable
- scrolling into view if needed
- done scrolling
- <div class="bruno-modal-backdrop"></div> from <div class="StyledWrapper__Wrapper-jjqtyM DwvBf">…</div> subtree intercepts pointer events
- retrying click action
- waiting 500ms
33 |
34 | await test.step('Open import collection modal', async () => {
> 35 | await locators.plusMenu.button().click();
| ^
36 | await locators.plusMenu.importCollection().click();
37 | const importModal = locators.import.modal();
38 | await importModal.waitFor({ state: 'visible' });
at /home/runner/work/bruno/bruno/tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:35:40
at /home/runner/work/bruno/bruno/tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:34:16
|
|
[default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully:
tests/import/postman/import-oauth2-implicit-grant-type.spec.ts#L0
3) [default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully › Open import collection modal
Test timeout of 30000ms exceeded.
|
|
[default] › tests/import/insomnia/import-insomnia-v5-environments.spec.ts:19:7 › Import Insomnia v5 Collection - Environment Import › Import Insomnia v5 collection with nested environments and verify flattening:
tests/import/insomnia/import-insomnia-v5-environments.spec.ts#L80
2) [default] › tests/import/insomnia/import-insomnia-v5-environments.spec.ts:19:7 › Import Insomnia v5 Collection - Environment Import › Import Insomnia v5 collection with nested environments and verify flattening › Test Base Environment - verify flattened keys
TimeoutError: locator.waitFor: Timeout 15000ms exceeded.
Call log:
- waiting for locator('input[value="config.debug"]') to be visible
78 | // key here guarantees every shallower input is also in DOM by the
79 | // time the per-input asserts below run.
> 80 | await page.locator('input[value="config.debug"]').waitFor({ state: 'visible', timeout: 15000 });
| ^
81 |
82 | // **Assertion 1: Basic Variables (Top-level keys)**
83 | // Verifies that simple key-value pairs from the base environment are imported correctly
at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v5-environments.spec.ts:80:57
at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v5-environments.spec.ts:67:5
|
|
[default] › tests/import/insomnia/import-insomnia-v4-environments.spec.ts:19:7 › Import Insomnia v4 Collection - Environment Import › Import Insomnia v4 collection with nested environments and verify flattening:
tests/import/insomnia/import-insomnia-v4-environments.spec.ts#L83
1) [default] › tests/import/insomnia/import-insomnia-v4-environments.spec.ts:19:7 › Import Insomnia v4 Collection - Environment Import › Import Insomnia v4 collection with nested environments and verify flattening › Test Base Environment - verify flattened keys
TimeoutError: locator.waitFor: Timeout 15000ms exceeded.
Call log:
- waiting for locator('input[value="user.roles[1]"]') to be visible
81 | // Waiting on the deepest asserted key here guarantees every shallower
82 | // input is also in DOM by the time the per-input asserts below run.
> 83 | await page.locator('input[value="user.roles[1]"]').waitFor({ state: 'visible', timeout: 15000 });
| ^
84 |
85 | // **Assertion 1: Basic Variables (Top-level keys)**
86 | // Verifies that simple key-value pairs from the base environment are imported correctly
at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v4-environments.spec.ts:83:58
at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v4-environments.spec.ts:70:5
|
|
CLI Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SSL Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
OAuth 1.0 Auth Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Unit Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Playwright E2E Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🎭 Playwright Run Summary
15 passed (2.1m)
|
|
🎭 Playwright Run Summary
4 flaky
[default] › tests/import/insomnia/import-insomnia-v4-environments.spec.ts:19:7 › Import Insomnia v4 Collection - Environment Import › Import Insomnia v4 collection with nested environments and verify flattening
[default] › tests/import/insomnia/import-insomnia-v5-environments.spec.ts:19:7 › Import Insomnia v5 Collection - Environment Import › Import Insomnia v5 collection with nested environments and verify flattening
[default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully
[system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC)
7 skipped
876 passed (55.4m)
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
playwright-report-linux
|
12.7 MB |
sha256:c0d713b52fd9446c2641ad3791234a86c5214ce724a763ecde19e808769d7c22
|
|
|
playwright-report-linux-ssl
|
278 KB |
sha256:469c6448d9f285565be89af1a039a7512ac7c8bc945a5787300ba657022a295a
|
|