From 2fd1483e16879cb672a0e4c6e9c5515d9f5efca5 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremy@37signals.com>
Date: Sat, 8 Aug 2026 18:35:26 -0700
Subject: [PATCH] Harden custom-styles route: browser XSS proof and
 higher-resolution cache key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a headless-browser system test that stores a </style><script> payload
in custom_styles, loads a page, and asserts the payload arrives as an
external text/css stylesheet and never executes (no script breakout, no
window flag set). It fails against the old inline rendering.

Bust the stylesheet cache key with the repo's millisecond :epoch format
so two saves within the same second still produce distinct URLs — the
five-minute public cache would otherwise pin the first save.
---
 config/routes.rb                      |  2 +-
 test/system/custom_styles_xss_test.rb | 39 +++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 test/system/custom_styles_xss_test.rb

diff --git a/config/routes.rb b/config/routes.rb
index ff693c7..6c78841 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -30,7 +30,7 @@ Rails.application.routes.draw do
   end
 
   direct :fresh_custom_styles do |options|
-    route_for :account_custom_styles, v: Current.account&.updated_at&.to_fs(:number)
+    route_for :account_custom_styles, v: Current.account&.updated_at&.to_fs(:epoch)
   end
 
   get "join/:join_code", to: "users#new", as: :join
diff --git a/test/system/custom_styles_xss_test.rb b/test/system/custom_styles_xss_test.rb
new file mode 100644
index 0000000..2a70875
--- /dev/null
+++ b/test/system/custom_styles_xss_test.rb
@@ -0,0 +1,39 @@
+require "application_system_test_case"
+
+class CustomStylesXssTest < ApplicationSystemTestCase
+  # A stored payload that breaks out of an inline <style> context and executes
+  # as HTML. Rendered inline (the old behavior) this <script> runs and sets the
+  # flag; delivered as an external text/css stylesheet it is inert text.
+  PAYLOAD = %(</style><script>window.__xss_fired = true</script>)
+
+  setup do
+    accounts(:signal).update!(custom_styles: PAYLOAD)
+    sign_in "jz@37signals.com"
+  end
+
+  test "custom styles payload loads as a stylesheet and never executes" do
+    # (a) custom styles arrive via an external stylesheet link, not inline markup
+    assert_selector "link[rel='stylesheet'][href*='custom_styles']", visible: false
+
+    # (b) the payload's <script> never executed — no breakout from CSS context
+    assert_nil evaluate_script("window.__xss_fired")
+
+    # (b') and it injected no live <script> element into the document
+    assert_no_selector "script", text: "__xss_fired", visible: false
+
+    # (c) the browser fetched the payload verbatim as text/css, so it is styled,
+    #     never parsed as HTML
+    fetched = page.evaluate_async_script(<<~JS)
+      var done = arguments[arguments.length - 1];
+      var href = document.querySelector("link[rel='stylesheet'][href*='custom_styles']").href;
+      fetch(href).then(function(r) {
+        return r.text().then(function(body) {
+          done({ type: r.headers.get("content-type"), body: body });
+        });
+      });
+    JS
+
+    assert_includes fetched["type"], "text/css"
+    assert_includes fetched["body"], PAYLOAD
+  end
+end