Something went wrong. Try again.
Monorepo for Tangled
Something went wrong. Try again.
12345678910111213141516171819202122232425262728293031323334353637import { describe, expect, it } from "vitest";import { signableTarget } from "$lib/server/camotarget";
const target = (url: string) => signableTarget(new URL(url));
describe("signableTarget", () => { it("allows public named http(s) hosts", () => { expect(target("https://example.com/a.png")).toBe(true); expect(target("http://i.imgcdn.test/a/b.png")).toBe(true); expect(target("https://mirror.example.co.uk:8443/x.png")).toBe(true); });
it("blocks ip literals", () => { expect(target("http://127.0.0.1:8090/x.png")).toBe(false); expect(target("http://10.0.0.9/x.png")).toBe(false); expect(target("http://[::1]/x.png")).toBe(false); expect(target("http://[fd00::1]/x.png")).toBe(false); });
it("blocks single-label service names", () => { expect(target("http://bobbin:8090/x.png")).toBe(false); expect(target("http://knot/x.png")).toBe(false); });
it("blocks internal-use suffixes", () => { expect(target("http://bobbin.internal/x.png")).toBe(false); expect(target("http://app.localhost/x.png")).toBe(false); expect(target("http://nas.local/x.png")).toBe(false); expect(target("http://vm.home.arpa/x.png")).toBe(false); });
it("rejects non-http(s) schemes upstream of the host check", () => { expect(target("file:///etc/passwd")).toBe(false); expect(target("javascript:alert(1)")).toBe(false); });});