Jakub Zych
43267de323
- TestAllowedURL and TestMenuTree (Docker-free): the URL scheme and target rules, BuildTree order, unreachable and looping entries, list and single registry types, generated children, locale alternates, left-out entries logged, the JSON shape - TestMenuEntryModel (Docker-free): fillable, rules, filter scope - TestMenuEntryBeforeSave, TestMenuAPI and TestMenuImport (Postgres): PHP beforeSave rules, D-16 API rules beyond the smoke test, import drops for page subtrees, foreign menus, missing parents, maps to nothing and unregistered types
35 lines
1.4 KiB
Go
35 lines
1.4 KiB
Go
package classes
|
|
|
|
import "testing"
|
|
|
|
// TestAllowedURL pins the D-16 URL scheme rule shared by the admin save and
|
|
// the public API: empty, a path, a fragment, or http, https, mailto and tel
|
|
// in any case; never javascript:, data:, vbscript: or another scheme, and
|
|
// never a URL with surrounding whitespace or control characters, which
|
|
// browsers strip before reading the scheme.
|
|
func TestAllowedURL(t *testing.T) {
|
|
for _, url := range []string{
|
|
"", "/", "/blog/post?x=1#a", "#top", "//cdn.example.test/a",
|
|
"http://example.test", "https://example.test/a", "HTTPS://EXAMPLE.TEST", "Http://x",
|
|
"mailto:a@example.test", "MAILTO:a@example.test", "tel:+48123456", "TEL:123",
|
|
} {
|
|
if !AllowedURL(url) {
|
|
t.Errorf("AllowedURL(%q) = false", url)
|
|
}
|
|
}
|
|
for _, url := range []string{
|
|
"javascript:alert(1)", "JavaScript:alert(1)", "data:text/html,x", "vbscript:x", "ftp://x", "file:///etc/passwd",
|
|
"blog", "example.test", "?q=1", "./a", "../a", "mailto", "https:x", "tel",
|
|
" /a", "/a ", "\thttps://x", "https://x\n", "java\tscript:x", "/a\x00b", "/a\x7f", "\x01javascript:x",
|
|
} {
|
|
if AllowedURL(url) {
|
|
t.Errorf("AllowedURL(%q) = true", url)
|
|
}
|
|
}
|
|
for target, want := range map[string]bool{"": true, TargetSelf: true, TargetBlank: true, "_top": false, "_parent": false, "_BLANK": false, "frame": false} {
|
|
if AllowedTarget(target) != want {
|
|
t.Errorf("AllowedTarget(%q) != %v", target, want)
|
|
}
|
|
}
|
|
}
|