Node / ReticulumProjects / MeshChatX.git / files / tests / frontend / deepLinks.docs.security.test.js

Displaying Raw • Download

T8b949e// SPDX-License-Identifier: 0BSD

Tff7b72import Tb4b4b4{ Te6edf3describeTb4b4b4, Te6edf3itTb4b4b4, Te6edf3expectTb4b4b4, Te6edf3viTb4b4b4, Te6edf3beforeEach Tb4b4b4} Tff7b72from Ta5d6ff"vitest"Tb4b4b4;

Tff7b72import Te6edf3App Tff7b72from Ta5d6ff"../../meshchatx/src/frontend/components/App.vue"Tb4b4b4;

Tff7b72import Tb4b4b4{ Te6edf3handleLxmIngestUriResult Tb4b4b4} Tff7b72from Ta5d6ff"../../meshchatx/src/frontend/js/ingestUriResultNavigation.js"Tb4b4b4;

Tff7b72import Te6edf3ToastUtils Tff7b72from Ta5d6ff"../../meshchatx/src/frontend/js/ToastUtils"Tb4b4b4;

Te6edf3viTb4b4b4.Te6edf3mockTb4b4b4(Ta5d6ff"../../meshchatx/src/frontend/js/ToastUtils"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4(Tb4b4b4{

Tff7b72defaultTff7b72: Tb4b4b4{

Te6edf3successTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3errorTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3infoTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3warningTff7b72: Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4)Tb4b4b4;

Te6edf3describeTb4b4b4(Ta5d6ff"meshchatx://docs deep links (security / fuzz)"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3beforeEachTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3viTb4b4b4.Te6edf3clearAllMocksTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"routes only hostname docs, not docs- prefix spoof"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3AppTb4b4b4.Te6edf3methodsTb4b4b4.Te6edf3handleProtocolLinkTb4b4b4.Te6edf3callTb4b4b4(Tb4b4b4{ Te6edf3$routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4} Tb4b4b4}Tb4b4b4, Ta5d6ff"meshchatx://docs-foo?reticulum=evil"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pushTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toHaveBeenCalledTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"accepts meshchat alias and path-style manual path"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3AppTb4b4b4.Te6edf3methodsTb4b4b4.Te6edf3handleProtocolLinkTb4b4b4.Te6edf3callTb4b4b4(Tb4b4b4{ Te6edf3$routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4} Tb4b4b4}Tb4b4b4, Ta5d6ff"meshchat://docs/manual/interfaces.html"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pushTb4b4b4)Tb4b4b4.Te6edf3toHaveBeenCalledWithTb4b4b4(Tb4b4b4{

Te6edf3nameTff7b72: Ta5d6ff"documentation"Tb4b4b4,

Te6edf3queryTff7b72: Tb4b4b4{ Te6edf3reticulumTff7b72: Tffa657encodeURIComponentTb4b4b4(Ta5d6ff"manual/interfaces.html"Tb4b4b4) Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"passes XSS-shaped reticulum through encodeURIComponent only (opaque to router)"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3malicious Tff7b72= Ta5d6ff"<script>alert(1)</script>"Tb4b4b4;

Te6edf3AppTb4b4b4.Te6edf3methodsTb4b4b4.Te6edf3handleProtocolLinkTb4b4b4.Te6edf3callTb4b4b4(

Tb4b4b4{ Te6edf3$routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4} Tb4b4b4}Tb4b4b4,

Ta5d6ff`Ta5d6ffmeshchatx://docs?reticulum=Tffd700${Tffa657encodeURIComponentTb4b4b4(Te6edf3maliciousTb4b4b4)Tffd700}Ta5d6ff`

Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pushTb4b4b4)Tb4b4b4.Te6edf3toHaveBeenCalledWithTb4b4b4(Tb4b4b4{

Te6edf3nameTff7b72: Ta5d6ff"documentation"Tb4b4b4,

Te6edf3queryTff7b72: Tb4b4b4{ Te6edf3reticulumTff7b72: Tffa657encodeURIComponentTb4b4b4(Te6edf3maliciousTb4b4b4) Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"does not treat javascript: prefix as docs link"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3AppTb4b4b4.Te6edf3methodsTb4b4b4.Te6edf3handleProtocolLinkTb4b4b4.Te6edf3callTb4b4b4(Tb4b4b4{ Te6edf3$routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4} Tb4b4b4}Tb4b4b4, Ta5d6ff"javascript:meshchatx://docs?reticulum=x"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pushTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toHaveBeenCalledWithTb4b4b4(Te6edf3expectTb4b4b4.Te6edf3objectContainingTb4b4b4(Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"documentation" Tb4b4b4}Tb4b4b4)Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"fuzz random query tails without throwing"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4;

Tff7b72for Tb4b4b4(Tff7b72let Te6edf3i Tff7b72= T79c0ff0Tb4b4b4; Te6edf3i Tff7b72< T79c0ff40Tb4b4b4; Te6edf3iTff7b72++Tb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3tail Tff7b72= Ta5d6ff`Ta5d6ffx=Tffd700${Tffa657encodeURIComponentTb4b4b4(Ta5d6ff`Tffd700${Te6edf3iTffd700}Ta5d6ff\uTa5d6ff0000<script>Ta5d6ff`Tb4b4b4)Tffd700}Ta5d6ff`Tb4b4b4;

Te6edf3expectTb4b4b4(Tb4b4b4(Tb4b4b4) Tb4b4b4=>

Te6edf3AppTb4b4b4.Te6edf3methodsTb4b4b4.Te6edf3handleProtocolLinkTb4b4b4.Te6edf3callTb4b4b4(Tb4b4b4{ Te6edf3$routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4} Tb4b4b4}Tb4b4b4, Ta5d6ff`Ta5d6ffmeshchatx://docs?Tffd700${Te6edf3tailTffd700}Ta5d6ff`Tb4b4b4)

Tb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toThrowTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"onWebsocketMessage docs_view navigates like handleProtocolLink"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3mockResolvedValueTb4b4b4(Tff7b72undefinedTb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3handled Tff7b72= Tff7b72await Te6edf3handleLxmIngestUriResultTb4b4b4(

Tb4b4b4{

Te6edf3typeTff7b72: Ta5d6ff"lxm.ingest_uri.result"Tb4b4b4,

Te6edf3statusTff7b72: Ta5d6ff"success"Tb4b4b4,

Te6edf3ingest_typeTff7b72: Ta5d6ff"docs_view"Tb4b4b4,

Te6edf3messageTff7b72: Ta5d6ff"Opening documentation."Tb4b4b4,

Te6edf3docs_queryTff7b72: Tb4b4b4{ Te6edf3reticulumTff7b72: Ta5d6ff"manual/interfaces.html#x" Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4}Tb4b4b4, Te6edf3toastTff7b72: Te6edf3ToastUtils Tb4b4b4}

Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3handledTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72trueTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pushTb4b4b4)Tb4b4b4.Te6edf3toHaveBeenCalledWithTb4b4b4(Tb4b4b4{

Te6edf3nameTff7b72: Ta5d6ff"documentation"Tb4b4b4,

Te6edf3queryTff7b72: Tb4b4b4{ Te6edf3reticulumTff7b72: Tffa657encodeURIComponentTb4b4b4(Ta5d6ff"manual/interfaces.html#x"Tb4b4b4) Tb4b4b4}Tb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3ToastUtilsTb4b4b4.Te6edf3infoTb4b4b4)Tb4b4b4.Te6edf3toHaveBeenCalledTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"onWebsocketMessage docs_view without docs_query opens documentation index"Tb4b4b4, Tff7b72async Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3push Tff7b72= Te6edf3viTb4b4b4.Te6edf3fnTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3mockResolvedValueTb4b4b4(Tff7b72undefinedTb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3handled Tff7b72= Tff7b72await Te6edf3handleLxmIngestUriResultTb4b4b4(

Tb4b4b4{

Te6edf3typeTff7b72: Ta5d6ff"lxm.ingest_uri.result"Tb4b4b4,

Te6edf3statusTff7b72: Ta5d6ff"success"Tb4b4b4,

Te6edf3ingest_typeTff7b72: Ta5d6ff"docs_view"Tb4b4b4,

Te6edf3messageTff7b72: Ta5d6ff"Opening documentation."Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4{ Te6edf3routerTff7b72: Tb4b4b4{ Te6edf3push Tb4b4b4}Tb4b4b4, Te6edf3toastTff7b72: Te6edf3ToastUtils Tb4b4b4}

Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3handledTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72trueTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pushTb4b4b4)Tb4b4b4.Te6edf3toHaveBeenCalledWithTb4b4b4(Tb4b4b4{ Te6edf3nameTff7b72: Ta5d6ff"documentation" Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;