xeno/Portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: close input normalization aliases

Browse Source
This commit is contained in:
LucaP
2026-09-02 00:44:38 +03:00
parent 0a34f90bb9
commit 6428b5dcd6
4 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tests/unit/content-schemas.test.ts
View File

@@ -60,6 +60,17 @@ describe('content schemas', () => {
})).toThrow(/production hostname is not approved/i);
});
it('rejects preview URL normalization aliases instead of accepting their normalized value', () => {
for (const canonicalUrl of [
'https://portfolio.localhost/.',
'https://portfolio.localhost/%2e',
'https://portfolio.localhost/?',
]) {
expect(() => parseSiteConfig({ environment: 'preview', canonicalUrl, buildId: 'preview-1' }))
.toThrow(/exactly https:\/\/portfolio\.localhost\//i);
}
});
it('rejects controls, non-NFC URLs, and ports at all public URL boundaries', () => {
expect(() => parseSiteConfig({
environment: 'preview', canonicalUrl: 'https://portfolio.localhost/\n', buildId: 'preview-1',

13
tests/unit/production-inputs.test.ts
View File

@@ -80,4 +80,17 @@ describe('production inputs', () => {
expect(() => assetUrl(manifest, 'selected-build-one', base)).toThrow(/asset url base/i);
}
});
it('rejects raw C0 controls and DEL in an asset URL base before URL parsing', () => {
const manifest = parsePublicAssetManifest(JSON.parse(readFileSync(fixtureUrl('asset-manifest.valid.json'), 'utf8')));
for (const base of [
'/assets/\n../private/',
'/assets/\nprivate/',
'/assets/\tprivate/',
'/assets/\rprivate/',
'/assets/\u007fprivate/',
]) {
expect(() => assetUrl(manifest, 'selected-build-one', base)).toThrow(/asset url base/i);
}
});
});