| 1 | import { describe, expect, it } from 'vitest'; |
| 2 | |
| 3 | import { callbackMatches } |
| 4 | |
| 5 | const registered = ' |
| 6 | |
| 7 | describe('callbackMatches', () |
| 8 | it.each([ |
| 9 | ['the registered callback itself', registered |
| 10 | ['a path under it', 'https://tool.example:8443/oauth/callback/github' |
| 11 | ['a query string on it', 'https://tool.example:8443/oauth/callback?next=%2Fhome |
| 12 | ])('accepts %s', (_ |
| 13 | expect(callbackMatches(registered |
| 14 | }); |
| 15 | |
| 16 | it.each([ |
| 17 | ['another host', 'https://evil.example:8443/oauth/callback' |
| 18 | ['a subdomain', 'https://sub.tool.example:8443/oauth/callback' |
| 19 | ['another port', 'https://tool.example:9443/oauth/callback' |
| 20 | ['another scheme', 'http://tool.example:8443/oauth/callback' |
| 21 | ['a sibling path', 'https://tool.example:8443/oauth/other' |
| 22 | ['a path that only shares a prefix', 'https://tool.example:8443/oauth/callbackevil |
| 23 | ['a path that climbs out', 'https://tool.example:8443/oauth/callback/../../steal |
| 24 | ['userinfo in the URL', 'https://me@tool.example:8443/oauth/callback' |
| 25 | ['a fragment', 'https://tool.example:8443/oauth/callback#x' |
| 26 | ['something that is not a URL', 'not a url' |
| 27 | ])('refuses %s', (_ |
| 28 | expect(callbackMatches(registered |
| 29 | }); |
| 30 | |
| 31 | it('treats a callback ending in a slash as the directory it names', |
| 32 | expect(callbackMatches('https://tool.example/cb/ |
| 33 | expect(callbackMatches('https://tool.example/cb/ |
| 34 | }); |
| 35 | }); |