Jakub Zych
882d4ee05f
safeImageURL and ValidURLRef refused only //, so a stored og_image of /\evil.example/x.png loaded a third-party image in the admin. Both now refuse /\ like models.validTarget already does.
31 lines
942 B
Go
31 lines
942 B
Go
package classes
|
|
|
|
import "testing"
|
|
|
|
// TestValidURLRef: a path or an absolute http(s) URL; a path that browsers
|
|
// read as another host (// or /\) is refused (WR-20).
|
|
func TestValidURLRef(t *testing.T) {
|
|
for v, want := range map[string]bool{
|
|
"/media/a.png": true,
|
|
"https://cdn.example/a.png": true,
|
|
"http://cdn.example/a.png": true,
|
|
"//evil.example/x.png": false,
|
|
`/\evil.example/x.png`: false,
|
|
"javascript:alert(1)": false,
|
|
"data:image/png;base64,AA": false,
|
|
"a.png": false,
|
|
"/a b.png": false,
|
|
"": false,
|
|
} {
|
|
if got := ValidURLRef(v); got != want {
|
|
t.Errorf("ValidURLRef(%q) = %v, want %v", v, got, want)
|
|
}
|
|
}
|
|
if !ValidImageURL("") {
|
|
t.Error("ValidImageURL(\"\") = false, want true (no image)")
|
|
}
|
|
if ValidImageURL(`/\evil.example/x.png`) {
|
|
t.Error(`ValidImageURL("/\evil.example/x.png") = true, want false`)
|
|
}
|
|
}
|