xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden portfolio input boundary

Browse Source
This commit is contained in:
LucaP
2026-09-02 00:40:09 +03:00
parent 4a704d89f7
commit 0a34f90bb9
5 changed files with 111 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tests/unit/production-inputs.test.ts
View File

@@ -62,6 +62,22 @@ describe('production inputs', () => {
it('resolves only an exact manifest asset ID to an encoded deterministic URL', () => {
const manifest = parsePublicAssetManifest(JSON.parse(readFileSync(fixtureUrl('asset-manifest.valid.json'), 'utf8')));
expect(assetUrl(manifest, 'selected-build-one')).toBe('/assets/selected-build-one.webp');
expect(assetUrl(manifest, 'selected-build-one', '/assets/cards')).toBe('/assets/cards/selected-build-one.webp');
expect(() => assetUrl(manifest, 'missing')).toThrow(/unknown asset/i);
});
it('rejects asset URL base traversal and origin escapes', () => {
const manifest = parsePublicAssetManifest(JSON.parse(readFileSync(fixtureUrl('asset-manifest.valid.json'), 'utf8')));
for (const base of [
'//cdn.example.test/assets/',
'/assets/../private/',
'/assets\\private/',
'/assets/%2e%2e/private/',
'/assets/%2fprivate/',
'/assets/?query=1',
'/assets/#fragment',
]) {
expect(() => assetUrl(manifest, 'selected-build-one', base)).toThrow(/asset url base/i);
}
});
});