get-return-to-path.test.ts58 lines · main

1	import { describe, expect, it } from 'vitest'
2
3	import { DEFAULT_FALLBACK_PATH, getReturnToPath } from '@/lib/gotrue'
4
5	describe(`getReturnToPath`, () => {
6	it(`returns to ${DEFAULT_FALLBACK_PATH} when no fallback is provided`, () => {
7	expect(getReturnToPath()).toBe(DEFAULT_FALLBACK_PATH)
8	})
9
10	it(`returns to /custom when fallback is provided`, () => {
11	expect(getReturnToPath('/custom')).toBe('/custom')
12	})
13
14	it(`returns to /custom`, () => {
15	// @ts-ignore
16	delete window.location
17	// @ts-ignore
18	window.location = { search: `?returnTo=/custom` }
19
20	expect(getReturnToPath()).toBe('/custom')
21	})
22
23	it(`returns to /custom?foo=bar`, () => {
24	// @ts-ignore
25	delete window.location
26	// @ts-ignore
27	window.location = { search: `?returnTo=/custom?foo=bar` }
28
29	expect(getReturnToPath()).toBe('/custom?foo=bar')
30	})
31
32	it(`does not return to https://google.com`, () => {
33	// @ts-ignore
34	delete window.location
35	// @ts-ignore
36	window.location = { search: `?returnTo=https://google.com` }
37
38	expect(getReturnToPath()).toBe(DEFAULT_FALLBACK_PATH)
39	})
40
41	it(`does not allow XSS`, () => {
42	// @ts-ignore
43	delete window.location
44	// @ts-ignore
45	window.location = { search: `?returnTo=javascript:alert(1)` }
46
47	expect(getReturnToPath()).toBe(DEFAULT_FALLBACK_PATH)
48	})
49
50	it(`does not allow XSS with encoded characters`, () => {
51	// @ts-ignore
52	delete window.location
53	// @ts-ignore
54	window.location = { search: `?returnTo=javascript%3Aalert%281%29` }
55
56	expect(getReturnToPath()).toBe(DEFAULT_FALLBACK_PATH)
57	})
58	})