28 lines
881 B
TypeScript
28 lines
881 B
TypeScript
import { safeNotificationActionUrl } from "../src/security/actionUrl";
|
|
|
|
function assertEqual(actual: unknown, expected: unknown, message: string): void {
|
|
if (actual !== expected) {
|
|
throw new Error(`${message}: expected ${String(expected)}, got ${String(actual)}`);
|
|
}
|
|
}
|
|
|
|
assertEqual(
|
|
safeNotificationActionUrl(" /calendar?event=event-1#details "),
|
|
"/calendar?event=event-1#details",
|
|
"application-relative links remain available"
|
|
);
|
|
|
|
for (const unsafe of [
|
|
"javascript:alert(1)",
|
|
"data:text/html,unsafe",
|
|
"https://attacker.example.test/collect",
|
|
"//attacker.example.test/collect",
|
|
"/\\attacker.example.test/collect",
|
|
"/calendar\nmalformed",
|
|
"/calendar\u007fmalformed"
|
|
]) {
|
|
assertEqual(safeNotificationActionUrl(unsafe), null, `unsafe link is suppressed: ${unsafe}`);
|
|
}
|
|
|
|
assertEqual(safeNotificationActionUrl(null), null, "missing links remain absent");
|