gotrue.test.ts51 lines · main

1	import { describe, expect, it } from 'vitest'
2
3	import { DEFAULT_FALLBACK_PATH, validateReturnTo } from './gotrue'
4
5	describe('validateReturnTo', () => {
6	const fallback = DEFAULT_FALLBACK_PATH
7
8	it('should return the path if it is a valid internal path', () => {
9	expect(validateReturnTo('/dashboard')).toBe('/dashboard')
10	expect(validateReturnTo('/settings/profile')).toBe('/settings/profile')
11	expect(validateReturnTo('/projects?id=123')).toBe('/projects?id=123')
12	})
13
14	it('should return fallback if given an external URL', () => {
15	expect(validateReturnTo('https://example.com')).toBe(fallback)
16	expect(validateReturnTo('http://malicious-site.com')).toBe(fallback)
17	expect(validateReturnTo('//evil.com')).toBe(fallback)
18	})
19
20	it('should return fallback for potentially malicious paths', () => {
21	expect(validateReturnTo('/%2e%2e/etc/passwd')).toBe(fallback)
22	expect(validateReturnTo('/..')).toBe(fallback)
23	expect(validateReturnTo('/@evil/path')).toBe(fallback)
24	expect(validateReturnTo('/$malicious')).toBe(fallback)
25	})
26
27	it('should use custom fallback when provided', () => {
28	const customFallback = '/custom-fallback'
29	expect(validateReturnTo('https://example.com', customFallback)).toBe(customFallback)
30	expect(validateReturnTo('/%2e%2e/etc/passwd', customFallback)).toBe(customFallback)
31	})
32
33	it('should handle paths with query parameters correctly', () => {
34	expect(validateReturnTo('/dashboard?param1=value1&param2=value2')).toBe(
35	'/dashboard?param1=value1&param2=value2'
36	)
37	})
38
39	it('should handle nextjs dynamic path js', () => {
40	expect(
41	validateReturnTo(
42	'%2F%5B%5Bx%5D%5Djavascript%3Aalert(%22H4CK3D%22)%2F%5By%5D%2F%5B%5Bx%5D%5D%2F%5By%5D%3Fx%26y'
43	)
44	).toBe(fallback)
45	expect(
46	validateReturnTo(
47	'/%2F%5B%5Bx%5D%5Djavascript%3Aalert(%22H4CK3D%22)%2F%5By%5D%2F%5B%5Bx%5D%5D%2F%5By%5D%3Fx%26y'
48	)
49	).toBe(fallback)
50	})
51	})