b9804ddf17
- models.AllowedFrontendURL: empty, or an absolute http(s) URL with a host and without whitespace, control characters, a double quote, <, > or & - classes.Rewrite leaves the document unchanged for a refused value, inserts through EscapeText/EscapeAttr and keeps a loc or href that would not stay an http(s) URL - TestRewriteUnsafeFrontendURL, TestAllowedFrontendURL and a stored-row check in TestSitemapImportSmoke
62 lines
1.5 KiB
Go
62 lines
1.5 KiB
Go
package models_test
|
||
|
||
import (
|
||
"testing"
|
||
|
||
"git.golem15.com/golem15/sm-sitemap-plugin/models"
|
||
)
|
||
|
||
// TestAllowedFrontendURL pins the one definition of a frontend_url that may
|
||
// be saved, imported and applied (T-17-15): empty, or an absolute http(s)
|
||
// URL with a host and without whitespace, control characters, a double
|
||
// quote, <, > or &.
|
||
func TestAllowedFrontendURL(t *testing.T) {
|
||
for _, u := range []string{
|
||
"",
|
||
"https://www.ex.pl",
|
||
"https://www.ex.pl/",
|
||
"https://www.ex.pl///",
|
||
"http://localhost:3000",
|
||
"HTTPS://WWW.EX.PL",
|
||
"https://www.ex.pl/app",
|
||
"https://www.ex.pl:8443/base/",
|
||
"https://[::1]:3000",
|
||
// The frontend URLs of the golden inputs.
|
||
"https://api.example.test",
|
||
"https://www.example.test/",
|
||
} {
|
||
if !models.AllowedFrontendURL(u) {
|
||
t.Errorf("AllowedFrontendURL(%q) = false, want true", u)
|
||
}
|
||
}
|
||
for _, u := range []string{
|
||
"0",
|
||
"javascript:alert(document.domain)//",
|
||
"JavaScript://www.ex.pl/%0aalert(1)",
|
||
`https://x"/><y a="`,
|
||
"https://www.ex.pl/?a=1&b=2",
|
||
"https://www.ex.pl <x>",
|
||
" https://www.ex.pl",
|
||
"https://www.ex.pl\n",
|
||
"https://www.ex.pl\t",
|
||
"https://www.ex.pl ",
|
||
"https://www.ex.pl\x7f",
|
||
"https://www.ex.pl\xff",
|
||
"//www.ex.pl",
|
||
"www.ex.pl",
|
||
"/path",
|
||
"https:///x",
|
||
"https://:8080",
|
||
"https:www.ex.pl",
|
||
"http://",
|
||
"https://",
|
||
"https://%zz",
|
||
"data:text/html,x",
|
||
"ftp://www.ex.pl",
|
||
} {
|
||
if models.AllowedFrontendURL(u) {
|
||
t.Errorf("AllowedFrontendURL(%q) = true, want false", u)
|
||
}
|
||
}
|
||
}
|