fix: add main-process Alta session boundary

2026-08-19 21:22:17 +00:00
parent f5cfdd8560
commit b503b5777a
8 changed files with 913 additions and 0 deletions
@@ -0,0 +1,57 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  canonicalizeAltaOrigin,
+  isAltaOrigin,
+} = require('../src/url-policy');
+
+test('accepts and canonicalizes HTTPS Alta deployment subdomains', () => {
+  assert.equal(canonicalizeAltaOrigin('https://Example.AVASECURITY.com/'), 'https://example.avasecurity.com');
+  assert.equal(canonicalizeAltaOrigin('https://edge.eu.avigilon.com:443'), 'https://edge.eu.avigilon.com');
+  assert.equal(isAltaOrigin('https://tenant.avasecurity.com'), true);
+});
+
+test('rejects roots, lookalikes, HTTP, and arbitrary exfiltration destinations', () => {
+  for (const value of [
+    'https://avasecurity.com',
+    'https://avigilon.com',
+    'https://avasecurity.com.evil.example',
+    'https://tenant.avasecurity.com.evil.example',
+    'https://evilavasecurity.com',
+    'http://tenant.avasecurity.com',
+    'https://example.com',
+    'file:///etc/passwd',
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
+  }
+});
+
+test('rejects authority tricks, fragments, paths, queries and non-default ports', () => {
+  for (const value of [
+    'https://user:pass@tenant.avasecurity.com',
+    'https://tenant.avasecurity.com/#fragment',
+    'https://tenant.avasecurity.com/api/v1/devices',
+    'https://tenant.avasecurity.com?next=https://evil.example',
+    'https://tenant.avasecurity.com:8443',
+    'https://tenant.avasecurity.com\\@evil.example',
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
+  }
+});
+
+test('rejects CRLF, whitespace, non-strings, oversized and malformed values', () => {
+  for (const value of [
+    'https://tenant.avasecurity.com\r\nX-Test: injected',
+    ' https://tenant.avasecurity.com',
+    'https://tenant.avasecurity.com ',
+    'not a URL',
+    '',
+    null,
+    7,
+    `https://${'a'.repeat(513)}.avasecurity.com`,
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, String(value));
+  }
+});