CNA-VGAP-052: The Inspector's WebBridge security checks and Agent::Stop paths have no automated test

CNA snapshot 009d40f5  ·  Known Issues › Verification gaps  ·  source links pinned to 009d40f5

No test drives the HTTP bridge (Host check, UI-token gate, 32-connection cap, request parsing, response headers), and no test calls Agent::Stop directly, stops an agent with a client attached, or starts an agent again after stopping one.

Identifier

CNA-VGAP-052

Category

Verification gap

Subsystem

Diagnostics & Inspector

Status

Open

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

Yes: see Current tests

Affected contract

CNA::Inspector::Detail::WebBridge (the cna-inspector browser bridge) and CNA::Inspector::Agent::Stop

Expected behaviour

The bridge controls docs/inspector.md lists under its security model, and the stop behaviour Agent.hpp documents (“safe to call more than once”; the destructor stops the agent), are pinned by regression tests.

Actual behaviour at TARGET

InspectorTests.cpp holds 7 protocol tests, 1 frontend-asset test (it inspects the embedded HTML and JavaScript strings) and 19 agent tests. None constructs WebBridge or sends HTTP: the exact Host: 127.0.0.1:<port> check, the x-cna-inspector-ui-token gate on /api/, the 503 at 32 concurrent connections, the one-second header timeout, the refusal of request bodies and the CSP/nosniff/no-store headers are verified only by the manual live HTTP smoke test docs/inspector.md reports. Every agent test destroys its Client before the std::unique_ptr<Agent>; no test calls Stop() directly or twice, stops while a client is connected (the path in which Stop shuts the active socket down so a blocked receive returns), or starts a new agent on a stopped agent's port.

Source locations

• modules/inspector/tests/CNA/Inspector/InspectorTests.cpp — protocol, frontend and agent tests; no WebBridge, no explicit Stop
• modules/inspector/src/WebBridge.cpp — WebBridge::Impl::Handle, Run, SendHttp; ParseHttpRequest
• modules/inspector/src/Agent.cpp — Agent::Impl::Stop
• modules/inspector/include/CNA/Inspector/Agent.hpp — Agent::Stop contract
• docs/inspector.md — Security model; Verification

Evidence

Checked by reading InspectorTests.cpp, WebBridge.cpp and Agent.cpp at 009d40f5. Reading the bridge found no defect in these checks; they are simply unpinned. Not executed, and the suite itself is compiled only with CNA_BUILD_INSPECTOR=ON, which no CI configuration sets.

Focused reproduction

No focused reproduction is known. Nothing has been invented here; the evidence above is what exists.

Current tests

InspectorTests.cpp: agent authentication, negotiation, rate limit, previews, reconnects and descriptor limits are covered; the bridge and stop paths are not.

Regression test

Bridge tests over a real loopback socket: a wrong Host gives 400, /api/ without the UI token gives 404, a 33rd concurrent connection gives 503, a request body gives 400, and every response carries the CSP header. Agent tests: Stop() twice, Stop() with a connected silent client returning well within the socket timeouts, and a restart on a fixed port.

Blast radius

The bridge's browser-facing defences (Host validation against DNS rebinding, the UI token against cross-origin API calls) and game shutdown through ~Agent; nothing in a build without CNA_BUILD_INSPECTOR.

Workaround

No workaround is known.