File size: 792 Bytes
45a105b | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | import { describe, it, expect } from 'vitest'
import { isSafeExternalUrl, isSafeInternalPath } from './url'
describe('open-redirect protection', () => {
it('allows listed hosts over http(s)', () => {
expect(isSafeExternalUrl('https://mock-bank.example/auth/x', ['mock-bank.example'])).toBe(true)
})
it('rejects other hosts and schemes', () => {
expect(isSafeExternalUrl('https://evil.com/x', ['mock-bank.example'])).toBe(false)
expect(isSafeExternalUrl('javascript:alert(1)', ['mock-bank.example'])).toBe(false)
expect(isSafeExternalUrl('data:text/html,x', ['mock-bank.example'])).toBe(false)
})
it('internal paths reject protocol-relative', () => {
expect(isSafeInternalPath('/pay')).toBe(true)
expect(isSafeInternalPath('//evil.com')).toBe(false)
})
})
|