Something went wrong. Try again.
Website hub for the atmosphere community, aggregating posts, events, regional, and more
Something went wrong. Try again.
3.9 kB · 144 lines
TypeScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145import assert from 'node:assert/strict'import test from 'node:test'import type { LexMap } from '@atproto/lex'
import { parseSharedEventRef, resolveStandardDocumentUrl, toSafeExternalHref,} from './community/shared-content.js'
const FALLBACK = 'https://fallback.example/'
test('parseSharedEventRef preserves the share record identity', () => { const shareRecordUri = 'at://did:plc:community/community.opensocial.sharedContent/3mshare' const ref = parseSharedEventRef( { type: 'event', documentUri: 'at://did:plc:event/community.lexicon.calendar.event/3mevent', sharedBy: 'did:plc:member', sharedAt: '2026-08-16T12:00:00.000Z', }, { source: 'atmosphere.community', shareRecordUri, shareRecordRkey: '3mshare', }, )
assert.equal(ref?.shareRecordUri, shareRecordUri) assert.equal(ref?.shareRecordRkey, '3mshare') assert.equal(ref?.sharedBy, 'did:plc:member')})
test('toSafeExternalHref accepts http and https URLs', () => { assert.equal( toSafeExternalHref('https://example.com/path', { fallback: FALLBACK }), 'https://example.com/path', ) assert.equal( toSafeExternalHref('http://example.com/path', { fallback: FALLBACK }), 'http://example.com/path', )})
test('toSafeExternalHref rejects javascript, data, vbscript, and file schemes', () => { assert.equal( toSafeExternalHref('javascript:alert(1)', { fallback: FALLBACK }), FALLBACK, ) assert.equal( toSafeExternalHref('data:text/html,<h1>bad</h1>', { fallback: FALLBACK }), FALLBACK, ) assert.equal( toSafeExternalHref('vbscript:MsgBox("bad")', { fallback: FALLBACK }), FALLBACK, ) assert.equal( toSafeExternalHref('file:///etc/passwd', { fallback: FALLBACK }), FALLBACK, )})
test('toSafeExternalHref rejects scheme-relative and obfuscated links', () => { assert.equal( toSafeExternalHref('//example.com/path', { fallback: FALLBACK }), FALLBACK, ) assert.equal( toSafeExternalHref(' javascript:alert(1)', { fallback: FALLBACK }), FALLBACK, ) assert.equal( toSafeExternalHref('\tjavascript:alert(1)', { fallback: FALLBACK }), FALLBACK, )})
test('toSafeExternalHref appends a relative path to a safe base', () => { assert.equal( toSafeExternalHref('https://example.com/blog', { path: 'post/1' }), 'https://example.com/blog/post/1', ) assert.equal( toSafeExternalHref('https://example.com/blog', { path: '/post/1' }), 'https://example.com/blog/post/1', )})
test('toSafeExternalHref rejects paths that carry their own authority or scheme', () => { assert.equal( toSafeExternalHref('https://example.com', { path: '//evil.example/path', fallback: FALLBACK, }), FALLBACK, ) assert.equal( toSafeExternalHref('https://example.com', { path: 'https://evil.example/path', fallback: FALLBACK, }), FALLBACK, ) assert.equal( toSafeExternalHref('https://example.com', { path: ' javascript:alert(1)', fallback: FALLBACK, }), FALLBACK, )})
test('resolveStandardDocumentUrl protects against absolute path override attempts', async () => { const document = { site: 'https://publisher.example', path: '//evil.example/path', } as LexMap const value = await resolveStandardDocumentUrl( document, 'did:example:alice', 'rkey', async () => null, FALLBACK, ) assert.equal(value, 'https://leaflet.pub/profile/did:example:alice/rkey')})
test('resolveStandardDocumentUrl rejects javascript path values', async () => { const document = { site: 'https://publisher.example', path: ' javascript:alert(1)', } as LexMap const value = await resolveStandardDocumentUrl( document, 'did:example:alice', 'rkey', async () => null, FALLBACK, ) assert.equal(value, 'https://leaflet.pub/profile/did:example:alice/rkey')})