37 lines
1.2 KiB
JavaScript
37 lines
1.2 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { buildAuthPath, getSafeAuthReturnTo } from "../src/lib/auth-return.ts";
|
|
|
|
test("keeps an internal route with its query and fragment", () => {
|
|
assert.equal(
|
|
getSafeAuthReturnTo("/events/summer-workshop?source=home#register"),
|
|
"/events/summer-workshop?source=home#register",
|
|
);
|
|
});
|
|
|
|
test("falls back for external and malformed return paths", () => {
|
|
for (const value of [
|
|
"https://attacker.example/",
|
|
"//attacker.example/",
|
|
"/\\attacker.example/",
|
|
`/${String.fromCharCode(0)}forbidden`,
|
|
"javascript:alert(1)",
|
|
]) {
|
|
assert.equal(getSafeAuthReturnTo(value), "/profile");
|
|
}
|
|
});
|
|
|
|
test("does not return to authentication or logout routes", () => {
|
|
for (const value of ["/auth", "/auth/google/callback", "/logout", "/reset-password"]) {
|
|
assert.equal(getSafeAuthReturnTo(value), "/profile");
|
|
}
|
|
});
|
|
|
|
test("builds a login link that safely encodes the requested route", () => {
|
|
assert.equal(
|
|
buildAuthPath("/events/summer-workshop?source=home"),
|
|
"/auth?next=%2Fevents%2Fsummer-workshop%3Fsource%3Dhome",
|
|
);
|
|
assert.equal(buildAuthPath("//attacker.example/"), "/auth?next=%2Fprofile");
|
|
});
|