49 lines
2.0 KiB
TypeScript
49 lines
2.0 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { matchAllowedOrigin, parseAllowedOrigins } from "./originCheck";
|
|
|
|
describe("parseAllowedOrigins", () => {
|
|
it("splits CSV and trims whitespace", () => {
|
|
expect(parseAllowedOrigins("https://a.example, https://b.example ,https://c.example")).toEqual([
|
|
"https://a.example",
|
|
"https://b.example",
|
|
"https://c.example",
|
|
]);
|
|
});
|
|
it("returns [] for empty / null / undefined", () => {
|
|
expect(parseAllowedOrigins("")).toEqual([]);
|
|
expect(parseAllowedOrigins(null)).toEqual([]);
|
|
expect(parseAllowedOrigins(undefined)).toEqual([]);
|
|
});
|
|
it("ignores empty entries from trailing commas", () => {
|
|
expect(parseAllowedOrigins(",https://a.example,,")).toEqual(["https://a.example"]);
|
|
});
|
|
});
|
|
|
|
describe("matchAllowedOrigin", () => {
|
|
it("rejects null origin", () => {
|
|
expect(matchAllowedOrigin(null, ["https://example.com"])).toBe(false);
|
|
});
|
|
it("rejects when allowlist is empty (fail-closed)", () => {
|
|
expect(matchAllowedOrigin("https://example.com", [])).toBe(false);
|
|
});
|
|
it("rejects malformed origin", () => {
|
|
expect(matchAllowedOrigin("not-a-url", ["https://example.com"])).toBe(false);
|
|
});
|
|
it("matches exact origin", () => {
|
|
expect(matchAllowedOrigin("https://example.com", ["https://example.com"])).toBe(true);
|
|
});
|
|
it("ignores path/query on incoming origin", () => {
|
|
expect(matchAllowedOrigin("https://example.com/page?x=1", ["https://example.com"])).toBe(true);
|
|
});
|
|
it("matches wildcard subdomain", () => {
|
|
expect(matchAllowedOrigin("https://app.example.com", ["https://*.example.com"])).toBe(true);
|
|
expect(matchAllowedOrigin("https://api.staging.example.com", ["https://*.example.com"])).toBe(false);
|
|
});
|
|
it("rejects different protocol", () => {
|
|
expect(matchAllowedOrigin("http://example.com", ["https://example.com"])).toBe(false);
|
|
});
|
|
it("rejects different host", () => {
|
|
expect(matchAllowedOrigin("https://attacker.com", ["https://example.com"])).toBe(false);
|
|
});
|
|
});
|