src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: stop pulling node:dns into client bundle via OAuth discovery

Browse Source
This commit is contained in:
Linus Rath
2026-05-18 19:31:38 +02:00
parent 43ac0725ce
commit ecd0467ffa
5 changed files with 54 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/__tests__/oauth-discovery.test.ts
+23 -25
View File
@@ -1,22 +1,20 @@
import { describe, it, expect, vi, beforeEach } from 'vitest';
import type { OAuthMetadata } from '../oauth/discovery';
vi.mock('../security/url-guard', () => ({
isPublicHttpUrl: vi.fn(async (urlString: string) => {
try {
const url = new URL(urlString);
if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
if (url.username || url.password) return false;
const host = url.hostname.toLowerCase();
if (host === 'localhost' || host.endsWith('.local') || host.endsWith('.internal')) return false;
if (/^(127\.|169\.254\.|10\.|192\.168\.)/.test(host)) return false;
if (host === '::1' || host === '0.0.0.0') return false;
return true;
} catch {
return false;
}
}),
}));
const validateEndpoint = async (urlString: string) => {
try {
const url = new URL(urlString);
if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
if (url.username || url.password) return false;
const host = url.hostname.toLowerCase();
if (host === 'localhost' || host.endsWith('.local') || host.endsWith('.internal')) return false;
if (/^(127\.|169\.254\.|10\.|192\.168\.)/.test(host)) return false;
if (host === '::1' || host === '0.0.0.0') return false;
return true;
} catch {
return false;
}
};
const VALID_METADATA: OAuthMetadata = {
issuer: 'https://auth.example.com',
@@ -43,7 +41,7 @@ describe('oauth/discovery', () => {
json: () => Promise.resolve(VALID_METADATA),
}));
const result = await discoverOAuth('https://mail.example.com');
const result = await discoverOAuth('https://mail.example.com', { validateEndpoint });
expect(result).toEqual(VALID_METADATA);
expect(fetch).toHaveBeenCalledTimes(1);
@@ -60,7 +58,7 @@ describe('oauth/discovery', () => {
json: () => Promise.resolve(VALID_METADATA),
}));
const result = await discoverOAuth('https://fallback.example.com');
const result = await discoverOAuth('https://fallback.example.com', { validateEndpoint });
expect(result).toEqual(VALID_METADATA);
expect(fetch).toHaveBeenCalledTimes(2);
@@ -76,7 +74,7 @@ describe('oauth/discovery', () => {
.mockResolvedValueOnce({ ok: false, status: 404 })
.mockResolvedValueOnce({ ok: false, status: 404 }));
const result = await discoverOAuth('https://fail.example.com');
const result = await discoverOAuth('https://fail.example.com', { validateEndpoint });
expect(result).toBeNull();
expect(consoleSpy).toHaveBeenCalled();
@@ -88,7 +86,7 @@ describe('oauth/discovery', () => {
json: () => Promise.resolve(VALID_METADATA),
}));
const result = await discoverOAuth('https://optional.example.com');
const result = await discoverOAuth('https://optional.example.com', { validateEndpoint });
expect(result?.revocation_endpoint).toBe('https://auth.example.com/revoke');
expect(result?.end_session_endpoint).toBe('https://auth.example.com/logout');
@@ -103,7 +101,7 @@ describe('oauth/discovery', () => {
})
.mockResolvedValueOnce({ ok: false, status: 404 }));
const result = await discoverOAuth('https://incomplete.example.com');
const result = await discoverOAuth('https://incomplete.example.com', { validateEndpoint });
expect(result).toBeNull();
expect(consoleSpy).toHaveBeenCalled();
@@ -122,7 +120,7 @@ describe('oauth/discovery', () => {
})
.mockResolvedValueOnce({ ok: false, status: 404 }));
const result = await discoverOAuth('https://evil.example.com');
const result = await discoverOAuth('https://evil.example.com', { validateEndpoint });
expect(result).toBeNull();
expect(consoleSpy).toHaveBeenCalled();
@@ -142,7 +140,7 @@ describe('oauth/discovery', () => {
})
.mockResolvedValueOnce({ ok: false, status: 404 }));
const result = await discoverOAuth('https://private-revoke.example.com');
const result = await discoverOAuth('https://private-revoke.example.com', { validateEndpoint });
expect(result).toBeNull();
expect(consoleSpy).toHaveBeenCalled();
@@ -154,8 +152,8 @@ describe('oauth/discovery', () => {
json: () => Promise.resolve(VALID_METADATA),
}));
const first = await discoverOAuth('https://cached.example.com');
const second = await discoverOAuth('https://cached.example.com');
const first = await discoverOAuth('https://cached.example.com', { validateEndpoint });
const second = await discoverOAuth('https://cached.example.com', { validateEndpoint });
expect(first).toEqual(VALID_METADATA);
expect(second).toEqual(VALID_METADATA);