10 lines
1.1 KiB
TypeScript
10 lines
1.1 KiB
TypeScript
import assert from 'node:assert/strict'
|
|
import {safeAuthReturnPath,permittedAuthReturnPath} from './auth-return-path'
|
|
for(const input of [null,undefined,'','https://outside.invalid','//outside.invalid','/\\outside.invalid','/auth/callback?next=/servers','/api/servers','/access-denied','/a/../auth/callback','/%2f%2foutside','/%5coutside','/%61uth/callback','/%73ettings','/servers\n','/servers?'+ 'a'.repeat(2048)])assert.equal(safeAuthReturnPath(input),null,String(input))
|
|
assert.equal(safeAuthReturnPath('/servers?server=42&tab=details#private-token'),'/servers?server=42&tab=details')
|
|
assert.equal(safeAuthReturnPath('/traffic?period=24h&name=%D0%A2%D0%B5%D1%81%D1%82'),'/traffic?period=24h&name=%D0%A2%D0%B5%D1%81%D1%82')
|
|
assert.equal(permittedAuthReturnPath('/servers?server=42',p=>p==='/servers','/dashboard'),'/servers?server=42')
|
|
assert.equal(permittedAuthReturnPath('/settings',p=>p==='/servers','/servers'),'/servers')
|
|
assert.equal(permittedAuthReturnPath('//outside.invalid',()=>true,'/servers'),'/servers')
|
|
console.log('auth return path: unsafe targets, normalized auth loops, query preservation and permission fallback passed')
|