48 lines
2.0 KiB
TypeScript
48 lines
2.0 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
// @ts-expect-error Node's native TypeScript runner resolves explicit .ts imports.
|
|
import { isSameOriginRequest } from "../lib/request-origin.ts";
|
|
|
|
function request(headers: Record<string, string>, url = "http://localhost:3000/api/workspace"): Request {
|
|
return new Request(url, { method: "POST", headers });
|
|
}
|
|
|
|
test("127.0.0.1 page may save when Next normalizes request.url to localhost", () => {
|
|
assert.equal(isSameOriginRequest(request({
|
|
Host: "127.0.0.1:3000",
|
|
Origin: "http://127.0.0.1:3000",
|
|
"Sec-Fetch-Site": "same-origin",
|
|
})), true);
|
|
});
|
|
|
|
test("localhost and IPv6 same-origin hosts may save", () => {
|
|
for (const host of ["localhost:3000", "[::1]:3000"]) {
|
|
assert.equal(isSameOriginRequest(request({ Host: host, Origin: `http://${host}` })), true);
|
|
}
|
|
});
|
|
|
|
test("evil origin and cross-site fetches remain forbidden", () => {
|
|
assert.equal(isSameOriginRequest(request({ Host: "127.0.0.1:3000", Origin: "https://evil.example" })), false);
|
|
assert.equal(isSameOriginRequest(request({
|
|
Host: "127.0.0.1:3000", Origin: "http://127.0.0.1:3000", "Sec-Fetch-Site": "cross-site",
|
|
})), false);
|
|
});
|
|
|
|
test("forwarded-host cannot override the actual Host header", () => {
|
|
assert.equal(isSameOriginRequest(request({
|
|
Host: "localhost:3000", Origin: "https://evil.example", "X-Forwarded-Host": "evil.example",
|
|
})), false);
|
|
});
|
|
|
|
test("port/protocol mismatches and malformed origins are forbidden", () => {
|
|
for (const origin of ["http://localhost:3001", "https://localhost:3000", "null", "broken", "http://localhost:3000/path"]) {
|
|
assert.equal(isSameOriginRequest(request({ Host: "localhost:3000", Origin: origin })), false);
|
|
}
|
|
});
|
|
|
|
test("non-browser clients without Origin remain supported, and URL is a Host fallback", () => {
|
|
assert.equal(isSameOriginRequest(request({})), true);
|
|
assert.equal(isSameOriginRequest(request({ Origin: "http://localhost:3000" })), true);
|
|
assert.equal(isSameOriginRequest(request({ "Sec-Fetch-Site": "cross-site" })), false);
|
|
});
|