mirror of
https://github.com/getpaseo/paseo.git
synced 2026-10-24 18:22:38 +00:00
Mohamed Boudra
fc3b2c4eb7
* fix(plugins): restrict overview content to safe Markdown and HTTPS destinations Registry overviews are author-controlled content read away from their repositories. Apply a shared presentation policy instead of the documentation renderer so relative links, non-HTTPS URLs, raw HTML, and author styles never become active overview content. * fix(plugins): choose the first allowed screenshot for previews
43 lines
1.1 KiB
TypeScript
43 lines
1.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { pluginOverviewUrl } from "./plugin-overview.js";
|
|
|
|
describe("plugin overview destinations", () => {
|
|
it.each([
|
|
undefined,
|
|
"",
|
|
"./docs",
|
|
"../docs",
|
|
"/login",
|
|
"//example.com",
|
|
"#section",
|
|
"?login",
|
|
"http://example.com",
|
|
"mailto:hello@example.com",
|
|
"ftp://example.com",
|
|
"javascript:alert(1)",
|
|
"data:image/png;base64,AAAA",
|
|
"vbscript:msgbox(1)",
|
|
"javascript:alert(1)",
|
|
"javascript%3Aalert(1)",
|
|
"javascript%253Aalert(1)",
|
|
"java\tscript:alert(1)",
|
|
" https://example.com",
|
|
"https://example.com\n",
|
|
"https:example.com",
|
|
"https:///example.com",
|
|
"https://paseo.sh@evil.example",
|
|
"https://example.com\\@evil.example",
|
|
"https://",
|
|
])("leaves %s as text", (url) => {
|
|
expect(pluginOverviewUrl(url)).toBeUndefined();
|
|
});
|
|
|
|
it.each([
|
|
"https://example.com/path?q=a&b=c#section",
|
|
"HTTPS://example.com/path",
|
|
"https://example.com/%3Cscript%3E",
|
|
])("allows %s without decoding it again", (url) => {
|
|
expect(pluginOverviewUrl(url)).toBe(url);
|
|
});
|
|
});
|