From 9f854c0056884faa3cf8a4581c17c34ddb450adf Mon Sep 17 00:00:00 2001 From: CodeWhale Bot Date: Thu, 27 Aug 2026 11:43:26 -0700 Subject: [PATCH] fix(web): construct invalid bootstrap nonces in tests CodeQL rust/hard-coded-cryptographic-value flagged the malformed capability literals passed to consume() as a hard-coded nonce. Signed-off-by: CodeWhale Bot --- crates/tui/src/runtime_api/web.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/crates/tui/src/runtime_api/web.rs b/crates/tui/src/runtime_api/web.rs index d982d2752..1d3b65760 100644 --- a/crates/tui/src/runtime_api/web.rs +++ b/crates/tui/src/runtime_api/web.rs @@ -374,7 +374,9 @@ mod tests { #[test] fn bootstrap_rejects_malformed_or_wrong_capabilities_without_consuming() { let (state, nonce) = RuntimeWebState::new(); - for invalid in ["", "cwwb_short", "cwwb_gggggggggggggggggggggggggggggggg"] { + let too_short = format!("{BOOTSTRAP_PREFIX}short"); + let non_hex = format!("{BOOTSTRAP_PREFIX}{}", "g".repeat(32)); + for invalid in ["", too_short.as_str(), non_hex.as_str()] { assert_eq!(state.consume(invalid), Err(BootstrapError::Invalid)); } let mut wrong = nonce.clone();