| import { describe, it, expect } from 'vitest' |
| import { isSafeExternalUrl, isSafeInternalPath } from './url' |
|
|
| describe('open-redirect protection', () => { |
| it('allows listed hosts over http(s)', () => { |
| expect(isSafeExternalUrl('https://mock-bank.example/auth/x', ['mock-bank.example'])).toBe(true) |
| }) |
| it('rejects other hosts and schemes', () => { |
| expect(isSafeExternalUrl('https://evil.com/x', ['mock-bank.example'])).toBe(false) |
| expect(isSafeExternalUrl('javascript:alert(1)', ['mock-bank.example'])).toBe(false) |
| expect(isSafeExternalUrl('data:text/html,x', ['mock-bank.example'])).toBe(false) |
| }) |
| it('internal paths reject protocol-relative', () => { |
| expect(isSafeInternalPath('/pay')).toBe(true) |
| expect(isSafeInternalPath('//evil.com')).toBe(false) |
| }) |
| }) |
|
|
