mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 17:45:42 +00:00
UNITRONIX
4c9a1f632e
Extend assertSafeApiId to organizations, resource-control, permissions, tokens, and update paths; harden org UI XSS and attachment confinement.
29 lines
1.1 KiB
JavaScript
29 lines
1.1 KiB
JavaScript
'use strict';
|
|
|
|
const {
|
|
assertSafeGoApiRelativePath,
|
|
assertSafeApiId,
|
|
} = require('../lib/goApiPath');
|
|
|
|
describe('goApiPath', () => {
|
|
test('accepts normal relative API paths', () => {
|
|
expect(assertSafeGoApiRelativePath('/peers')).toBe('/peers');
|
|
expect(assertSafeGoApiRelativePath('/org/acme/policy')).toBe('/org/acme/policy');
|
|
expect(assertSafeGoApiRelativePath('/peers?id=1')).toBe('/peers?id=1');
|
|
});
|
|
|
|
test('rejects absolute and traversal paths', () => {
|
|
expect(() => assertSafeGoApiRelativePath('http://evil.com/x')).toThrow();
|
|
expect(() => assertSafeGoApiRelativePath('//evil.com/x')).toThrow();
|
|
expect(() => assertSafeGoApiRelativePath('/org/../secrets')).toThrow();
|
|
expect(() => assertSafeGoApiRelativePath('peers')).toThrow();
|
|
});
|
|
|
|
test('assertSafeApiId validates identifiers', () => {
|
|
expect(assertSafeApiId('device-123', 'device')).toBe('device-123');
|
|
expect(() => assertSafeApiId('../x', 'device')).toThrow();
|
|
expect(() => assertSafeApiId('..', 'orgId')).toThrow();
|
|
expect(() => assertSafeApiId('.', 'orgId')).toThrow();
|
|
});
|
|
});
|