Skip to content

fix(oauth2): prevent code injection in OAuth2 callback handling #1162

fix(oauth2): prevent code injection in OAuth2 callback handling

fix(oauth2): prevent code injection in OAuth2 callback handling #1162

Triggered via pull request June 29, 2026 09:19
Status Failure
Total duration 58m 0s
Artifacts 2

tests-linux.yml

on: pull_request
Unit Tests (Linux)
6m 10s
Unit Tests (Linux)
CLI Tests (Linux)
3m 32s
CLI Tests (Linux)
Playwright E2E Tests (Linux)
57m 56s
Playwright E2E Tests (Linux)
SSL Tests (Linux)
5m 6s
SSL Tests (Linux)
OAuth 1.0 Auth Tests (Linux)
5m 48s
OAuth 1.0 Auth Tests (Linux)
Fit to window
Zoom out
Zoom in

Annotations

7 errors, 5 warnings, and 2 notices
OAuth 1.0 Auth Tests (Linux)
Process completed with exit code 1.
[system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC): tests/proxy/system-pac/system-pac-proxy.spec.ts#L0
4) [system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC) Retry #1 ─────────────────────────────────────────────────────────────────────────────────────── Error: listen EADDRINUSE: address already in use 127.0.0.1:18080
[system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC): tests/proxy/system-pac/system-pac-proxy.spec.ts#L0
4) [system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC) Error: listen EADDRINUSE: address already in use 127.0.0.1:18080
[default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully: tests/import/postman/import-oauth2-implicit-grant-type.spec.ts#L35
3) [default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully › Open import collection modal TimeoutError: locator.click: Timeout 30000ms exceeded. Call log: - waiting for getByTestId('collections-header-add-menu') - locator resolved to <button tabindex="-1" aria-expanded="false" data-tabindex="inline" title="Add new collection" data-testid="collections-header-add-menu" class="StyledWrapper-iYvzMB btWNSr action-icon">…</button> - attempting click action 2 × waiting for element to be visible, enabled and stable - element is visible, enabled and stable - scrolling into view if needed - done scrolling - <div class="bruno-modal-backdrop"></div> from <div class="StyledWrapper__Wrapper-jjqtyM DwvBf">…</div> subtree intercepts pointer events - retrying click action - waiting 20ms 2 × waiting for element to be visible, enabled and stable - element is visible, enabled and stable - scrolling into view if needed - done scrolling - <div class="bruno-modal-backdrop"></div> from <div class="StyledWrapper__Wrapper-jjqtyM DwvBf">…</div> subtree intercepts pointer events - retrying click action - waiting 100ms 58 × waiting for element to be visible, enabled and stable - element is visible, enabled and stable - scrolling into view if needed - done scrolling - <div class="bruno-modal-backdrop"></div> from <div class="StyledWrapper__Wrapper-jjqtyM DwvBf">…</div> subtree intercepts pointer events - retrying click action - waiting 500ms 33 | 34 | await test.step('Open import collection modal', async () => { > 35 | await locators.plusMenu.button().click(); | ^ 36 | await locators.plusMenu.importCollection().click(); 37 | const importModal = locators.import.modal(); 38 | await importModal.waitFor({ state: 'visible' }); at /home/runner/work/bruno/bruno/tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:35:40 at /home/runner/work/bruno/bruno/tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:34:16
[default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully: tests/import/postman/import-oauth2-implicit-grant-type.spec.ts#L0
3) [default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully › Open import collection modal Test timeout of 30000ms exceeded.
[default] › tests/import/insomnia/import-insomnia-v5-environments.spec.ts:19:7 › Import Insomnia v5 Collection - Environment Import › Import Insomnia v5 collection with nested environments and verify flattening: tests/import/insomnia/import-insomnia-v5-environments.spec.ts#L80
2) [default] › tests/import/insomnia/import-insomnia-v5-environments.spec.ts:19:7 › Import Insomnia v5 Collection - Environment Import › Import Insomnia v5 collection with nested environments and verify flattening › Test Base Environment - verify flattened keys TimeoutError: locator.waitFor: Timeout 15000ms exceeded. Call log: - waiting for locator('input[value="config.debug"]') to be visible 78 | // key here guarantees every shallower input is also in DOM by the 79 | // time the per-input asserts below run. > 80 | await page.locator('input[value="config.debug"]').waitFor({ state: 'visible', timeout: 15000 }); | ^ 81 | 82 | // **Assertion 1: Basic Variables (Top-level keys)** 83 | // Verifies that simple key-value pairs from the base environment are imported correctly at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v5-environments.spec.ts:80:57 at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v5-environments.spec.ts:67:5
[default] › tests/import/insomnia/import-insomnia-v4-environments.spec.ts:19:7 › Import Insomnia v4 Collection - Environment Import › Import Insomnia v4 collection with nested environments and verify flattening: tests/import/insomnia/import-insomnia-v4-environments.spec.ts#L83
1) [default] › tests/import/insomnia/import-insomnia-v4-environments.spec.ts:19:7 › Import Insomnia v4 Collection - Environment Import › Import Insomnia v4 collection with nested environments and verify flattening › Test Base Environment - verify flattened keys TimeoutError: locator.waitFor: Timeout 15000ms exceeded. Call log: - waiting for locator('input[value="user.roles[1]"]') to be visible 81 | // Waiting on the deepest asserted key here guarantees every shallower 82 | // input is also in DOM by the time the per-input asserts below run. > 83 | await page.locator('input[value="user.roles[1]"]').waitFor({ state: 'visible', timeout: 15000 }); | ^ 84 | 85 | // **Assertion 1: Basic Variables (Top-level keys)** 86 | // Verifies that simple key-value pairs from the base environment are imported correctly at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v4-environments.spec.ts:83:58 at /home/runner/work/bruno/bruno/tests/import/insomnia/import-insomnia-v4-environments.spec.ts:70:5
CLI Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SSL Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OAuth 1.0 Auth Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Unit Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Playwright E2E Tests (Linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🎭 Playwright Run Summary
15 passed (2.1m)
🎭 Playwright Run Summary
4 flaky [default] › tests/import/insomnia/import-insomnia-v4-environments.spec.ts:19:7 › Import Insomnia v4 Collection - Environment Import › Import Insomnia v4 collection with nested environments and verify flattening [default] › tests/import/insomnia/import-insomnia-v5-environments.spec.ts:19:7 › Import Insomnia v5 Collection - Environment Import › Import Insomnia v5 collection with nested environments and verify flattening [default] › tests/import/postman/import-oauth2-implicit-grant-type.spec.ts:22:7 › Import Postman Collection with OAuth2.0 Implicit Grant Type › should import Postman collection with OAuth2.0 Implicit Grant Type successfully [system-pac] › tests/proxy/system-pac/system-pac-proxy.spec.ts:84:7 › System Proxy with PAC › resolves OS-level PAC URL in system proxy mode (file:// PAC) 7 skipped 876 passed (55.4m)

Artifacts

Produced during runtime
Name Size Digest
playwright-report-linux
12.7 MB
sha256:c0d713b52fd9446c2641ad3791234a86c5214ce724a763ecde19e808769d7c22
playwright-report-linux-ssl
278 KB
sha256:469c6448d9f285565be89af1a039a7512ac7c8bc945a5787300ba657022a295a