chore(tests): disable `update` button in CI
What the developer wrote
Authored by Ioan Bizău
chore(tests): disable `update` button in CI
[no changelog]
What changed, and why it matters
This commit disables an 'update' button in a test report web page when the page is not loaded from the user's own computer (localhost). The change is a hardening measure to prevent someone from accidentally or maliciously triggering test-result updates from a publicly hosted copy of the report. It is not a fix for a known exploit in shipped Trezor firmware.
No immediate action required for end users. For developers, confirm that the update endpoint behind the button is also protected server-side if the report is ever hosted on a shared CI environment, since client-side disabling can be bypassed.
Security signals we found
Client-side UI control restricted by origin/hostname
No authentication or authorization mechanism added
Test-only reporting code path, not production firmware
No changelog entry; marked as chore/tests
Evidence from the diff
The patch adds a client-side JavaScript guard in tests/ui_tests/reporting/testreport.js. On page load, if window.location.hostname is not localhost/127.0.0.1/::1, the element with id ‘mark-update’ is disabled and visually greyed out. This restricts an update action to local-only use, likely because the same HTML report may be served as a CI artifact where the button would otherwise be active but non-functional or misleading. There is no server-side logic change, no firmware change, and no changelog entry.
Changed components
tests/ui_tests/reporting/testreport.jsInspect captured patch +9 / −0
diff --git a/tests/ui_tests/reporting/testreport.js b/tests/ui_tests/reporting/testreport.js
index fb63672a..2a1d1d9a 100644
--- a/tests/ui_tests/reporting/testreport.js
+++ b/tests/ui_tests/reporting/testreport.js
@@ -133,6 +133,15 @@ function onLoadTestCase() {
const markbox = document.getElementById("markbox");
+ if (!["localhost", "127.0.0.1", "::1"].includes(window.location.hostname)) {
+ const updateButton = document.getElementById("mark-update");
+ updateButton.disabled = true;
+ updateButton.style.backgroundColor = "#ccc";
+ updateButton.style.color = "#666";
+ updateButton.style.cursor = "not-allowed";
+ updateButton.title = "Only possible locally";
+ }
+
const links = [];
for (const [url, label, key] of [[window.prevHref, "[p]rev case", "p"], [window.nextHref, "[n]ext case", "n"]]) {
if (url) {
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.