Node / ReticulumProjects / MeshChatX.git / files / tests / frontend / mapLinkUtils.security.test.js

Displaying Raw • Download

T8b949e// SPDX-License-Identifier: 0BSD

Tff7b72import Tb4b4b4{ Te6edf3describeTb4b4b4, Te6edf3itTb4b4b4, Te6edf3expect Tb4b4b4} Tff7b72from Ta5d6ff"vitest"Tb4b4b4;

Tff7b72import Tb4b4b4{

Te6edf3buildMeshchatMapUriTb4b4b4,

Te6edf3buildWebHashMapUrlTb4b4b4,

Te6edf3findMapUriInContentTb4b4b4,

Te6edf3mapLinkKindFromMessageTb4b4b4,

Te6edf3parseMeshchatMapUriTb4b4b4,

Tb4b4b4} Tff7b72from Ta5d6ff"@/js/mapLinkUtils.js"Tb4b4b4;

Tff7b72const Te6edf3XSS_MARKERS Tff7b72= Tb4b4b4[

Ta5d6ff"<script>alert(1)</script>"Tb4b4b4,

Ta5d6ff'"><img src=x onerror=alert(1)>'Tb4b4b4,

Ta5d6ff"javascript:alert(1)"Tb4b4b4,

Ta5d6ff"';DROP TABLE t;--"Tb4b4b4,

Ta5d6ff"<svg/onload=alert(1)>"Tb4b4b4,

Ta5d6ff"\u003cscript\u003e"Tb4b4b4,

Tb4b4b4]Tb4b4b4;

Te6edf3describeTb4b4b4(Ta5d6ff"mapLinkUtils security and XSS-related parsing"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3itTb4b4b4(Ta5d6ff"round-trips map URIs with XSS-like label and layers as plain strings"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72for Tb4b4b4(Tff7b72const Te6edf3marker Tff7b72of Te6edf3XSS_MARKERSTb4b4b4) Tb4b4b4{

Tff7b72const Te6edf3uri Tff7b72= Te6edf3buildMeshchatMapUriTb4b4b4(Tb4b4b4{

Te6edf3latTff7b72: T79c0ff1Tb4b4b4,

Te6edf3lonTff7b72: T79c0ff2Tb4b4b4,

Te6edf3zoomTff7b72: T79c0ff5Tb4b4b4,

Te6edf3layersTff7b72: Te6edf3markerTb4b4b4,

Te6edf3labelTff7b72: Te6edf3markerTb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tff7b72const Te6edf3p Tff7b72= Te6edf3parseMeshchatMapUriTb4b4b4(Te6edf3uriTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toBeNullTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pTb4b4b4.Te6edf3layersTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Te6edf3markerTb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3pTb4b4b4.Te6edf3labelTb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Te6edf3markerTb4b4b4)Tb4b4b4;

Tb4b4b4}

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"findMapUriInContent stops before angle brackets and whitespace"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3expectTb4b4b4(Te6edf3findMapUriInContentTb4b4b4(Ta5d6ff"x meshchatx://map?lat=1&lon=2&z=3<evil"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"meshchatx://map?lat=1&lon=2&z=3"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3findMapUriInContentTb4b4b4(Ta5d6ff"meshchatx://map?lat=1&lon=2 z=3"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"meshchatx://map?lat=1&lon=2"Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"classifies ping only from line-start prefix or label=ping"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3uri Tff7b72= Ta5d6ff"meshchatx://map?lat=0&lon=0&z=3&label=ping"Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3mapLinkKindFromMessageTb4b4b4(Ta5d6ff"<script>MeshChatX map ping:</script> " Tff7b72+ Te6edf3uriTb4b4b4, Tff7b72nullTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"view"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3mapLinkKindFromMessageTb4b4b4(Ta5d6ff"not a ping MeshChatX map ping: " Tff7b72+ Te6edf3uriTb4b4b4, Tff7b72nullTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"view"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3mapLinkKindFromMessageTb4b4b4(Ta5d6ff"MeshChatX map ping: " Tff7b72+ Te6edf3uriTb4b4b4, Te6edf3parseMeshchatMapUriTb4b4b4(Te6edf3uriTb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"ping"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3mapLinkKindFromMessageTb4b4b4(Ta5d6ff"<b>MeshChatX map ping:</b> fake"Tb4b4b4, Tff7b72nullTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"view"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3mapLinkKindFromMessageTb4b4b4(Ta5d6ff"hello"Tb4b4b4, Te6edf3parseMeshchatMapUriTb4b4b4(Te6edf3uriTb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"ping"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3mapLinkKindFromMessageTb4b4b4(Ta5d6ff"hello"Tb4b4b4, Tb4b4b4{ Te6edf3labelTff7b72: Ta5d6ff"not-ping" Tb4b4b4}Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Ta5d6ff"view"Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"buildWebHashMapUrl encodes dangerous characters in query values"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Tff7b72const Te6edf3marker Tff7b72= Ta5d6ff"<script>alert(1)</script>"Tb4b4b4;

Tff7b72const Te6edf3u Tff7b72= Te6edf3buildWebHashMapUrlTb4b4b4(Tb4b4b4{

Te6edf3latTff7b72: T79c0ff0Tb4b4b4,

Te6edf3lonTff7b72: T79c0ff0Tb4b4b4,

Te6edf3zoomTff7b72: T79c0ff4Tb4b4b4,

Te6edf3layersTff7b72: Te6edf3markerTb4b4b4,

Te6edf3labelTff7b72: Te6edf3markerTb4b4b4,

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3uTb4b4b4)Tb4b4b4.Te6edf3notTb4b4b4.Te6edf3toContainTb4b4b4(Ta5d6ff"<script>"Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Ta5d6ff/%3[cC]script%3[eE]/iTb4b4b4.Te6edf3testTb4b4b4(Te6edf3uTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeTb4b4b4(Tff7b72trueTb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Te6edf3itTb4b4b4(Ta5d6ff"rejects map URLs with javascript host confusion"Tb4b4b4, Tb4b4b4(Tb4b4b4) Tb4b4b4=> Tb4b4b4{

Te6edf3expectTb4b4b4(Te6edf3parseMeshchatMapUriTb4b4b4(Ta5d6ff"javascript:meshchatx://map?lat=1&lon=2&z=3"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeNullTb4b4b4(Tb4b4b4)Tb4b4b4;

Te6edf3expectTb4b4b4(Te6edf3parseMeshchatMapUriTb4b4b4(Ta5d6ff"meshchatx://mapper?lat=1&lon=2&z=3"Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toBeNullTb4b4b4(Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;

Tb4b4b4}Tb4b4b4)Tb4b4b4;