1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
// Copyright 2023 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package httplib
import (
"testing"
"code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/test"
"github.com/stretchr/testify/assert"
)
func TestIsRiskyRedirectURL(t *testing.T) {
defer test.MockVariableValue(&setting.AppURL, "http://localhost:3000/sub/")()
defer test.MockVariableValue(&setting.AppSubURL, "/sub")()
tests := []struct {
input string
want bool
}{
{"", false},
{"foo", false},
{"./", false},
{"?key=val", false},
{"/sub/", false},
{"http://localhost:3000/sub/", false},
{"/sub/foo", false},
{"http://localhost:3000/sub/foo", false},
{"http://localhost:3000/sub/test?param=false", false},
// FIXME: should probably be true (would requires resolving references using setting.appURL.ResolveReference(u))
{"/sub/../", false},
{"http://localhost:3000/sub/../", false},
{"/sUb/", false},
{"http://localhost:3000/sUb/foo", false},
{"/sub", false},
{"/foo?k=%20#abc", false},
{"/", false},
{"a/", false},
{"test?param=false", false},
{"/hey/hey/hey#3244", false},
{"//", true},
{"\\\\", true},
{"/\\", true},
{"\\/", true},
{"mail:a@b.com", true},
{"https://test.com", true},
{"http://localhost:3000/foo", true},
{"http://localhost:3000/sub", true},
{"http://localhost:3000/sub?key=val", true},
{"https://example.com/", true},
{"//example.com", true},
{"http://example.com", true},
{"http://localhost:3000/test?param=false", true},
{"//localhost:3000/test?param=false", true},
{"://missing protocol scheme", true},
// FIXME: should probably be false
{"//localhost:3000/sub/test?param=false", true},
}
for _, tt := range tests {
t.Run(tt.input, func(t *testing.T) {
assert.Equal(t, tt.want, IsRiskyRedirectURL(tt.input))
})
}
}
func TestIsRiskyRedirectURLWithoutSubURL(t *testing.T) {
defer test.MockVariableValue(&setting.AppURL, "https://next.forgejo.org/")()
defer test.MockVariableValue(&setting.AppSubURL, "")()
tests := []struct {
input string
want bool
}{
{"", false},
{"foo", false},
{"./", false},
{"?key=val", false},
{"/sub/", false},
{"https://next.forgejo.org/sub/", false},
{"/sub/foo", false},
{"https://next.forgejo.org/sub/foo", false},
{"https://next.forgejo.org/sub/test?param=false", false},
{"https://next.forgejo.org/sub/../", false},
{"/sub/../", false},
{"/sUb/", false},
{"https://next.forgejo.org/sUb/foo", false},
{"/sub", false},
{"/foo?k=%20#abc", false},
{"/", false},
{"a/", false},
{"test?param=false", false},
{"/hey/hey/hey#3244", false},
{"https://next.forgejo.org/test?param=false", false},
{"https://next.forgejo.org/foo", false},
{"https://next.forgejo.org/sub", false},
{"https://next.forgejo.org/sub?key=val", false},
{"//", true},
{"\\\\", true},
{"/\\", true},
{"\\/", true},
{"mail:a@b.com", true},
{"https://test.com", true},
{"https://example.com/", true},
{"//example.com", true},
{"http://example.com", true},
{"://missing protocol scheme", true},
{"https://forgejo.org", true},
{"https://example.org?url=https://next.forgejo.org", true},
// FIXME: should probably be false
{"https://next.forgejo.org", true},
{"//next.forgejo.org/test?param=false", true},
{"//next.forgejo.org/sub/test?param=false", true},
}
for _, tt := range tests {
t.Run(tt.input, func(t *testing.T) {
assert.Equal(t, tt.want, IsRiskyRedirectURL(tt.input))
})
}
}
|
