Automerge backed Markdown editor for the Atmosphere
Something went wrong. Try again.
12345678910111213141516171819202122232425import { test } from 'node:test'import assert from 'node:assert/strict'import { readFile } from 'node:fs/promises'import { JSDOM } from 'jsdom'
test('actual callback page forwards the original query/fragment URL through both channels', async () => { const html = await readFile(new URL('../../public/oauth-callback.html', import.meta.url), 'utf8') const callbackUrl = 'https://reams.test/oauth-callback.html?code=code&state=state&iss=https%3A%2F%2Fissuer.test#iss=https%3A%2F%2Fevil.test' const posted = [] const dom = new JSDOM(html, { url: callbackUrl, runScripts: 'dangerously', beforeParse(window) { window.setTimeout = () => 0 window.opener = { postMessage: (data, origin) => posted.push({ data, origin }) } } }) try { const stored = JSON.parse(dom.window.localStorage.getItem('reams:oauth-callback')) assert.equal(stored.callback_url, callbackUrl) assert.equal(stored.code, 'code') assert.equal(stored.state, 'state') assert.equal(new URL(stored.callback_url).searchParams.get('iss'), 'https://issuer.test') assert.equal(new URLSearchParams(new URL(stored.callback_url).hash.slice(1)).get('iss'), 'https://evil.test') // A real postMessage structured-clones into the receiving realm. assert.deepEqual(JSON.parse(JSON.stringify(posted)), [{ data: stored, origin: 'https://reams.test' }]) } finally { dom.window.close() }})