新增 labels 下的韩泰 EOT 标注工作台

2026-10-09 13:12:52 +08:00
parent 1ab51c8bc1
commit 138b08a8e4
23 changed files with 4326 additions and 0 deletions
@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+// @ts-expect-error Node's native TypeScript runner resolves explicit .ts imports.
+import { isSameOriginRequest } from "../lib/request-origin.ts";
+
+function request(headers: Record<string, string>, url = "http://localhost:3000/api/workspace"): Request {
+  return new Request(url, { method: "POST", headers });
+}
+
+test("127.0.0.1 page may save when Next normalizes request.url to localhost", () => {
+  assert.equal(isSameOriginRequest(request({
+    Host: "127.0.0.1:3000",
+    Origin: "http://127.0.0.1:3000",
+    "Sec-Fetch-Site": "same-origin",
+  })), true);
+});
+
+test("localhost and IPv6 same-origin hosts may save", () => {
+  for (const host of ["localhost:3000", "[::1]:3000"]) {
+    assert.equal(isSameOriginRequest(request({ Host: host, Origin: `http://${host}` })), true);
+  }
+});
+
+test("evil origin and cross-site fetches remain forbidden", () => {
+  assert.equal(isSameOriginRequest(request({ Host: "127.0.0.1:3000", Origin: "https://evil.example" })), false);
+  assert.equal(isSameOriginRequest(request({
+    Host: "127.0.0.1:3000", Origin: "http://127.0.0.1:3000", "Sec-Fetch-Site": "cross-site",
+  })), false);
+});
+
+test("forwarded-host cannot override the actual Host header", () => {
+  assert.equal(isSameOriginRequest(request({
+    Host: "localhost:3000", Origin: "https://evil.example", "X-Forwarded-Host": "evil.example",
+  })), false);
+});
+
+test("port/protocol mismatches and malformed origins are forbidden", () => {
+  for (const origin of ["http://localhost:3001", "https://localhost:3000", "null", "broken", "http://localhost:3000/path"]) {
+    assert.equal(isSameOriginRequest(request({ Host: "localhost:3000", Origin: origin })), false);
+  }
+});
+
+test("non-browser clients without Origin remain supported, and URL is a Host fallback", () => {
+  assert.equal(isSameOriginRequest(request({})), true);
+  assert.equal(isSameOriginRequest(request({ Origin: "http://localhost:3000" })), true);
+  assert.equal(isSameOriginRequest(request({ "Sec-Fetch-Site": "cross-site" })), false);
+});