18 lines
861 B
TypeScript
18 lines
861 B
TypeScript
import { describe, expect, test } from "vitest";
|
|
|
|
import { getSafeAssistantHttpUrl } from "./assistant-url";
|
|
|
|
describe("getSafeAssistantHttpUrl", () => {
|
|
test("allows ordinary HTTP and HTTPS source URLs", () => {
|
|
expect(getSafeAssistantHttpUrl("https://example.com/source?q=homarr")).toBe("https://example.com/source?q=homarr");
|
|
expect(getSafeAssistantHttpUrl("http://example.com/source")).toBe("http://example.com/source");
|
|
});
|
|
|
|
test("rejects unsafe protocols, relative URLs, and embedded credentials", () => {
|
|
expect(getSafeAssistantHttpUrl("javascript:alert(1)")).toBeNull();
|
|
expect(getSafeAssistantHttpUrl("data:text/html;base64,PGgxPkJhZDwvaDE+")).toBeNull();
|
|
expect(getSafeAssistantHttpUrl("/manage/custom-widgets")).toBeNull();
|
|
expect(getSafeAssistantHttpUrl("https://user:secret@example.com/source")).toBeNull();
|
|
});
|
|
});
|