summaryrefslogtreecommitdiffstats
path: root/modules/httplib/url_test.go
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--modules/httplib/url_test.go123
1 files changed, 123 insertions, 0 deletions
diff --git a/modules/httplib/url_test.go b/modules/httplib/url_test.go
new file mode 100644
index 0000000..2842edd
--- /dev/null
+++ b/modules/httplib/url_test.go
@@ -0,0 +1,123 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package httplib
+
+import (
+ "testing"
+
+ "code.gitea.io/gitea/modules/setting"
+ "code.gitea.io/gitea/modules/test"
+
+ "github.com/stretchr/testify/assert"
+)
+
+func TestIsRiskyRedirectURL(t *testing.T) {
+ defer test.MockVariableValue(&setting.AppURL, "http://localhost:3000/sub/")()
+ defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
+
+ tests := []struct {
+ input string
+ want bool
+ }{
+ {"", false},
+ {"foo", false},
+ {"./", false},
+ {"?key=val", false},
+ {"/sub/", false},
+ {"http://localhost:3000/sub/", false},
+ {"/sub/foo", false},
+ {"http://localhost:3000/sub/foo", false},
+ {"http://localhost:3000/sub/test?param=false", false},
+ // FIXME: should probably be true (would requires resolving references using setting.appURL.ResolveReference(u))
+ {"/sub/../", false},
+ {"http://localhost:3000/sub/../", false},
+ {"/sUb/", false},
+ {"http://localhost:3000/sUb/foo", false},
+ {"/sub", false},
+ {"/foo?k=%20#abc", false},
+ {"/", false},
+ {"a/", false},
+ {"test?param=false", false},
+ {"/hey/hey/hey#3244", false},
+
+ {"//", true},
+ {"\\\\", true},
+ {"/\\", true},
+ {"\\/", true},
+ {"mail:a@b.com", true},
+ {"https://test.com", true},
+ {"http://localhost:3000/foo", true},
+ {"http://localhost:3000/sub", true},
+ {"http://localhost:3000/sub?key=val", true},
+ {"https://example.com/", true},
+ {"//example.com", true},
+ {"http://example.com", true},
+ {"http://localhost:3000/test?param=false", true},
+ {"//localhost:3000/test?param=false", true},
+ {"://missing protocol scheme", true},
+ // FIXME: should probably be false
+ {"//localhost:3000/sub/test?param=false", true},
+ }
+ for _, tt := range tests {
+ t.Run(tt.input, func(t *testing.T) {
+ assert.Equal(t, tt.want, IsRiskyRedirectURL(tt.input))
+ })
+ }
+}
+
+func TestIsRiskyRedirectURLWithoutSubURL(t *testing.T) {
+ defer test.MockVariableValue(&setting.AppURL, "https://next.forgejo.org/")()
+ defer test.MockVariableValue(&setting.AppSubURL, "")()
+
+ tests := []struct {
+ input string
+ want bool
+ }{
+ {"", false},
+ {"foo", false},
+ {"./", false},
+ {"?key=val", false},
+ {"/sub/", false},
+ {"https://next.forgejo.org/sub/", false},
+ {"/sub/foo", false},
+ {"https://next.forgejo.org/sub/foo", false},
+ {"https://next.forgejo.org/sub/test?param=false", false},
+ {"https://next.forgejo.org/sub/../", false},
+ {"/sub/../", false},
+ {"/sUb/", false},
+ {"https://next.forgejo.org/sUb/foo", false},
+ {"/sub", false},
+ {"/foo?k=%20#abc", false},
+ {"/", false},
+ {"a/", false},
+ {"test?param=false", false},
+ {"/hey/hey/hey#3244", false},
+ {"https://next.forgejo.org/test?param=false", false},
+ {"https://next.forgejo.org/foo", false},
+ {"https://next.forgejo.org/sub", false},
+ {"https://next.forgejo.org/sub?key=val", false},
+
+ {"//", true},
+ {"\\\\", true},
+ {"/\\", true},
+ {"\\/", true},
+ {"mail:a@b.com", true},
+ {"https://test.com", true},
+ {"https://example.com/", true},
+ {"//example.com", true},
+ {"http://example.com", true},
+ {"://missing protocol scheme", true},
+ {"https://forgejo.org", true},
+ {"https://example.org?url=https://next.forgejo.org", true},
+ // FIXME: should probably be false
+ {"https://next.forgejo.org", true},
+ {"//next.forgejo.org/test?param=false", true},
+ {"//next.forgejo.org/sub/test?param=false", true},
+ }
+ for _, tt := range tests {
+ t.Run(tt.input, func(t *testing.T) {
+ assert.Equal(t, tt.want, IsRiskyRedirectURL(tt.input))
+ })
+ }
+}