105 lines
3.9 KiB
TypeScript
105 lines
3.9 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import {
|
|
isValidFrameOrigin,
|
|
sanitizeFrameOrigins,
|
|
} from '@/lib/admin/csp-frame-origins';
|
|
|
|
describe('isValidFrameOrigin', () => {
|
|
it('accepts plain https origins', () => {
|
|
expect(isValidFrameOrigin('https://www.youtube-nocookie.com')).toBe(true);
|
|
expect(isValidFrameOrigin('https://meet.example.com')).toBe(true);
|
|
expect(isValidFrameOrigin('https://a.b.c.example.com')).toBe(true);
|
|
});
|
|
|
|
it('accepts a wildcard subdomain', () => {
|
|
expect(isValidFrameOrigin('https://*.example.com')).toBe(true);
|
|
expect(isValidFrameOrigin('https://*.youtube.com')).toBe(true);
|
|
});
|
|
|
|
it('accepts an explicit port', () => {
|
|
expect(isValidFrameOrigin('https://meet.example.com:8443')).toBe(true);
|
|
expect(isValidFrameOrigin('https://*.example.com:443')).toBe(true);
|
|
});
|
|
|
|
it('rejects non-https schemes', () => {
|
|
expect(isValidFrameOrigin('http://example.com')).toBe(false);
|
|
expect(isValidFrameOrigin('ftp://example.com')).toBe(false);
|
|
expect(isValidFrameOrigin('data:text/html,foo')).toBe(false);
|
|
expect(isValidFrameOrigin('javascript:alert(1)')).toBe(false);
|
|
});
|
|
|
|
it('rejects bare schemes and wildcard hosts', () => {
|
|
expect(isValidFrameOrigin('https://')).toBe(false);
|
|
expect(isValidFrameOrigin('https://*')).toBe(false);
|
|
expect(isValidFrameOrigin('https://*.com')).toBe(false);
|
|
expect(isValidFrameOrigin('https://localhost')).toBe(false);
|
|
});
|
|
|
|
it('rejects paths, queries, and fragments', () => {
|
|
expect(isValidFrameOrigin('https://example.com/embed')).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com/')).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com?x=1')).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com#x')).toBe(false);
|
|
});
|
|
|
|
it('rejects userinfo, IPs, and IPv6', () => {
|
|
expect(isValidFrameOrigin('https://user:pass@example.com')).toBe(false);
|
|
expect(isValidFrameOrigin('https://1.2.3.4')).toBe(false);
|
|
expect(isValidFrameOrigin('https://[::1]')).toBe(false);
|
|
});
|
|
|
|
it('rejects values that try to break out of the directive', () => {
|
|
expect(isValidFrameOrigin("https://example.com'; script-src 'unsafe-eval")).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com" data:')).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com data:')).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com\nhttps://evil.com')).toBe(false);
|
|
expect(isValidFrameOrigin('https://example.com;https://evil.com')).toBe(false);
|
|
expect(isValidFrameOrigin('https://exa,mple.com')).toBe(false);
|
|
});
|
|
|
|
it('rejects non-strings and obvious garbage', () => {
|
|
expect(isValidFrameOrigin(undefined)).toBe(false);
|
|
expect(isValidFrameOrigin(null)).toBe(false);
|
|
expect(isValidFrameOrigin(42)).toBe(false);
|
|
expect(isValidFrameOrigin('')).toBe(false);
|
|
expect(isValidFrameOrigin('not-a-url')).toBe(false);
|
|
expect(isValidFrameOrigin('a'.repeat(300))).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('sanitizeFrameOrigins', () => {
|
|
it('returns empty for non-array input', () => {
|
|
expect(sanitizeFrameOrigins(undefined)).toEqual([]);
|
|
expect(sanitizeFrameOrigins(null)).toEqual([]);
|
|
expect(sanitizeFrameOrigins('https://example.com')).toEqual([]);
|
|
expect(sanitizeFrameOrigins({})).toEqual([]);
|
|
});
|
|
|
|
it('keeps valid entries and drops invalid ones silently', () => {
|
|
expect(
|
|
sanitizeFrameOrigins([
|
|
'https://www.youtube-nocookie.com',
|
|
'http://insecure.com',
|
|
'https://meet.example.com:8443',
|
|
'https://example.com/path',
|
|
42,
|
|
'https://*.vimeo.com',
|
|
]),
|
|
).toEqual([
|
|
'https://www.youtube-nocookie.com',
|
|
'https://meet.example.com:8443',
|
|
'https://*.vimeo.com',
|
|
]);
|
|
});
|
|
|
|
it('dedupes case-insensitively', () => {
|
|
expect(
|
|
sanitizeFrameOrigins([
|
|
'https://Example.com',
|
|
'https://example.com',
|
|
'https://EXAMPLE.com',
|
|
]),
|
|
).toEqual(['https://Example.com']);
|
|
});
|
|
});
|