Files

T

spirit 68a486cf9b test: Add comprehensive unit tests

- IdleTimerTest.kt: 6 tests for timeout calculations
- ConfigValidationTest.kt: 16 tests for config validation
  - Homepage URL validation
  - Admin PIN validation (4-8 digits)
  - Whitelist parsing and normalization
- Updated IMPROVEMENTS.md with test coverage

Total unit tests: 29

2026-02-03 15:13:23 +00:00

1.7 KiB

Raw Permalink Blame History

Improvements & Code Review Notes

Security Fixes Applied

P0: Whitelist Bypass Vulnerability (FIXED)

Issue: Original whitelist check used url.contains(domain) which would allow bypass:

https://hobbs.farm.evil.com would match hobbs.farm ❌

Fix: Use proper domain boundary matching:

val host = Uri.parse(url).host?.lowercase() ?: return false
return whitelist.any { domain ->
    host == domain || host.endsWith(".$domain")
}

Recommended Future Improvements

P1: PIN Storage Security

Current: Plain text in DataStore
Recommended: SHA-256 hash with salt
Implementation: Use MessageDigest to hash before storing

P2: UX Enhancements

Add loading indicator (ProgressBar) during page loads
Add network error screen with retry button
Consider swipe-to-refresh in admin settings

P2: Code Quality

Add unit tests for whitelist logic (added: WhitelistTest.kt)
Add instrumented tests for WebView behavior
Consider Kotlin coroutines for async operations

Test Coverage

Component	Tests	Status
Whitelist matching	7	✅
Idle timer	6	✅
Config validation	16	✅
Boot receiver	-	N/A (integration)

Total Unit Tests: 29

Test Files

WhitelistTest.kt — URL whitelist logic with bypass prevention
IdleTimerTest.kt — Timeout calculations and edge cases
ConfigValidationTest.kt — Homepage, PIN, and whitelist validation

Future Tests (Instrumented)

WebView URL blocking behavior
Admin PIN dialog flow
Lock Task Mode integration
Boot receiver launch

Code review by Spirit 👻 Coordinated by Pluto 🪐

1.7 KiB Raw Permalink Blame History