Hardening + localStorage/sessionStorage tracking and scan robustness (1.2.0) - #6
Merged
Merged
Conversation
- publish.yml: add id-token:write permission + --provenance flag - package.json: add conditional exports map, lint script (tsc --noEmit), prepublishOnly now runs lint + test + build - ci.yml: non-blocking npm audit --audit-level=high step - package.json: drop misleading playwright keyword (Puppeteer-only) - README: add "How this differs from a static cookie scanner" section Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…er-dismissed wait
Correctness + feature work:
- scanner: snapshot localStorage/sessionStorage keys before and after Reject All;
tracker-pattern keys that persist or newly appear are recorded as violations
- types: add `source` discriminator to Violation ('cookie' | 'localStorage' |
'sessionStorage' | 'request'), 'storage' violation type, StorageSnapshot,
and storageBefore/storageAfter on the result
- cookie-classifier: add isTrackingStorageKey() reusing tracking cookie patterns
- scanner: cmpLoadDelay option (default 2000) replaces hardcoded sleep(2000)
- scanner: after a successful reject click, wait for the banner element to
disappear (waitForBannerDismissed) before measuring after-state
- cmp-detector: expose bannerSelector on CMPDetectionResult so the scanner can
poll for dismissal
- cli: --cmp-delay flag; strict --format and --timeout validation; export
parseArgs + formatters; guard main() so the module can be imported without
launching a browser; surface storage violations in table + text output
- index: export isTrackingStorageKey and StorageSnapshot
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…n logic - tests/cli.test.ts: parseArgs defaults, URL scheme prefixing, --cmp-delay, format validation, timeout/cmp-delay numeric validation, unknown-option and missing-URL handling; formatTable/formatText rendering incl. storage violations and empty-domain handling - tests/scanner.test.ts: mock puppeteer (launch → browser → page) and assert violation-detection logic — persisted tracking cookie, localStorage tracker key set/persists after reject, sessionStorage persistence wording, non-tracking keys ignored, storage snapshots surfaced on the result Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump version and document the hardening + feature changes in this branch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…orage-tracking # Conflicts: # CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supply-chain/packaging hardening plus a real correctness gap (storage-based tracking) and scan-robustness improvements. Releases 1.2.0.
Tier 1 — hardening
id-token: write+--provenance)exportsmap (keepsmain/typesfor back-compat)prepublishOnlynow runslint && test && buildnpm audit --audit-level=highstep in CI (no real-browser tests added to CI)playwrightkeyword (the package uses Puppeteer)Tier 2 — correctness / features
--cmp-delay <ms>flag to control the consent-banner load wait (was a hardcoded 2s)--formatand--timeoutTests
New mock-Puppeteer scanner tests (violation logic, storage detection) and CLI tests (arg parsing, validation, formatters). 81/81 passing,
tsc --noEmit+ build clean.🤖 Generated with Claude Code