Jakub Zych
882d4ee05f
safeImageURL and ValidURLRef refused only //, so a stored og_image of /\evil.example/x.png loaded a third-party image in the admin. Both now refuse /\ like models.validTarget already does.
19 lines
715 B
TypeScript
19 lines
715 B
TypeScript
import { describe, expect, it } from 'vitest'
|
|
import { safeImageURL } from '../../assets/src/elements/image'
|
|
|
|
// E7 golem15-seo-image: which stored URLs the preview may load.
|
|
|
|
describe('E7 safeImageURL', () => {
|
|
it('accepts a path and an http(s) URL', () => {
|
|
for (const url of ['/media/a.png', 'https://cdn.example/a.png', 'HTTP://cdn.example/a.png']) {
|
|
expect(safeImageURL(url), url).toBe(true)
|
|
}
|
|
})
|
|
|
|
it('refuses addresses a browser reads as another host or another scheme (WR-20)', () => {
|
|
for (const url of ['//evil.example/x.png', '/\\evil.example/x.png', 'javascript:alert(1)', 'data:image/png;base64,AA', 'a.png', '']) {
|
|
expect(safeImageURL(url), url).toBe(false)
|
|
}
|
|
})
|
|
})
|