mirror of
https://github.com/yu-i-i/overleaf-cep.git
synced 2026-05-27 11:01:56 +02:00
6c005da303
Handle double slash case of safe redirect paths GitOrigin-RevId: fb6e8ea9d736a65df61f07d563235262b8aaf0f3
40 lines
1.2 KiB
JavaScript
40 lines
1.2 KiB
JavaScript
const chai = require('chai')
|
|
const { expect } = chai
|
|
const SandboxedModule = require('sandboxed-module')
|
|
const modulePath = require('path').join(
|
|
__dirname,
|
|
'../../../../app/src/Features/Helpers/UrlHelper.js'
|
|
)
|
|
|
|
describe('UrlHelper', function() {
|
|
beforeEach(function() {
|
|
this.UrlHelper = SandboxedModule.require(modulePath, {})
|
|
})
|
|
describe('getSafeRedirectPath', function() {
|
|
it('sanitize redirect path to prevent open redirects', function() {
|
|
expect(this.UrlHelper.getSafeRedirectPath('https://evil.com')).to.be
|
|
.undefined
|
|
|
|
expect(this.UrlHelper.getSafeRedirectPath('//evil.com')).to.be.undefined
|
|
|
|
expect(this.UrlHelper.getSafeRedirectPath('//ol.com/evil')).to.equal(
|
|
'/evil'
|
|
)
|
|
|
|
expect(this.UrlHelper.getSafeRedirectPath('////evil.com')).to.be.undefined
|
|
|
|
expect(this.UrlHelper.getSafeRedirectPath('%2F%2Fevil.com')).to.equal(
|
|
'/%2F%2Fevil.com'
|
|
)
|
|
|
|
expect(
|
|
this.UrlHelper.getSafeRedirectPath('http://foo.com//evil.com/bad')
|
|
).to.equal('/evil.com/bad')
|
|
|
|
return expect(this.UrlHelper.getSafeRedirectPath('.evil.com')).to.equal(
|
|
'/.evil.com'
|
|
)
|
|
})
|
|
})
|
|
})
|