File size: 1,253 Bytes
5f24abe | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | import { describe, expect, test } from "bun:test"
import { sanitizeServerActionRequest } from "../src/lib/server-action"
describe("server action referer", () => {
test("preserves same-origin return locations", () => {
const request = new Request("https://dev.opencode.ai/_server?id=action", {
headers: { referer: "https://dev.opencode.ai/auth?next=%2Fconsole" },
})
expect(sanitizeServerActionRequest(request)).toBe(request)
})
test("replaces unsafe return locations with the request origin", () => {
const referers = ["https://evil.example/phishing-login", "not a url", undefined]
expect(
referers.map((referer) =>
sanitizeServerActionRequest(
new Request("https://dev.opencode.ai/_server?id=action", {
headers: referer === undefined ? undefined : { referer },
}),
).headers.get("referer"),
),
).toEqual(["https://dev.opencode.ai", "https://dev.opencode.ai", "https://dev.opencode.ai"])
})
test("does not change other routes", () => {
const request = new Request("https://dev.opencode.ai/auth", {
headers: { referer: "https://evil.example/phishing-login" },
})
expect(sanitizeServerActionRequest(request)).toBe(request)
})
})
|