58 lines
2.0 KiB
JavaScript
58 lines
2.0 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const {
|
|
canonicalizeAltaOrigin,
|
|
isAltaOrigin,
|
|
} = require('../src/url-policy');
|
|
|
|
test('accepts and canonicalizes HTTPS Alta deployment subdomains', () => {
|
|
assert.equal(canonicalizeAltaOrigin('https://Example.AVASECURITY.com/'), 'https://example.avasecurity.com');
|
|
assert.equal(canonicalizeAltaOrigin('https://edge.eu.avigilon.com:443'), 'https://edge.eu.avigilon.com');
|
|
assert.equal(isAltaOrigin('https://tenant.avasecurity.com'), true);
|
|
});
|
|
|
|
test('rejects roots, lookalikes, HTTP, and arbitrary exfiltration destinations', () => {
|
|
for (const value of [
|
|
'https://avasecurity.com',
|
|
'https://avigilon.com',
|
|
'https://avasecurity.com.evil.example',
|
|
'https://tenant.avasecurity.com.evil.example',
|
|
'https://evilavasecurity.com',
|
|
'http://tenant.avasecurity.com',
|
|
'https://example.com',
|
|
'file:///etc/passwd',
|
|
]) {
|
|
assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
|
|
}
|
|
});
|
|
|
|
test('rejects authority tricks, fragments, paths, queries and non-default ports', () => {
|
|
for (const value of [
|
|
'https://user:pass@tenant.avasecurity.com',
|
|
'https://tenant.avasecurity.com/#fragment',
|
|
'https://tenant.avasecurity.com/api/v1/devices',
|
|
'https://tenant.avasecurity.com?next=https://evil.example',
|
|
'https://tenant.avasecurity.com:8443',
|
|
'https://tenant.avasecurity.com\\@evil.example',
|
|
]) {
|
|
assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
|
|
}
|
|
});
|
|
|
|
test('rejects CRLF, whitespace, non-strings, oversized and malformed values', () => {
|
|
for (const value of [
|
|
'https://tenant.avasecurity.com\r\nX-Test: injected',
|
|
' https://tenant.avasecurity.com',
|
|
'https://tenant.avasecurity.com ',
|
|
'not a URL',
|
|
'',
|
|
null,
|
|
7,
|
|
`https://${'a'.repeat(513)}.avasecurity.com`,
|
|
]) {
|
|
assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, String(value));
|
|
}
|
|
});
|