301194963b
一些检查失败了
automerge / automerge (push) Has been cancelled
react-native-android-build-apk / AssembleRelease (push) Has been cancelled
Build macOS M1 / Main (push) Has been cancelled
Joplin Continuous Integration / Main (macos-15-intel) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-11-vs2026-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-2025) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04-arm) (push) Has been cancelled
Joplin UI tests / Main (ubuntu-22.04) (push) Has been cancelled
Joplin UI tests / Main (windows-2025) (push) Has been cancelled
Joplin UI tests / Mobile (push) Has been cancelled
Close stale issues / ProcessStaleIssues (push) Has been cancelled
42 行
1.3 KiB
TypeScript
42 行
1.3 KiB
TypeScript
import { isAllowedPairingOrigin, isPairingPath } from './ClipperServer';
|
|
|
|
describe('ClipperServer', () => {
|
|
|
|
test.each([
|
|
// The router strips all leading slashes, so the gate must too, otherwise
|
|
// e.g. //auth would skip the check but still reach the auth handler.
|
|
['/auth', true],
|
|
['/auth/check', true],
|
|
['//auth', true],
|
|
['///auth/check', true],
|
|
['auth', true],
|
|
['/notes', false],
|
|
['/auth_other', false],
|
|
['', false],
|
|
])('should identify pairing path %s -> %s', (pathname, expected) => {
|
|
expect(isPairingPath(pathname)).toBe(expected);
|
|
});
|
|
|
|
test.each([
|
|
// Web origins must be rejected: these are the CSRF vector.
|
|
['http://attacker.example', false],
|
|
['https://attacker.example', false],
|
|
['http://127.0.0.1:41184', false],
|
|
['https://localhost', false],
|
|
|
|
// Extension origins are the legitimate caller.
|
|
['chrome-extension://some-extension-id', true],
|
|
['moz-extension://11111111-2222-3333-4444-555555555555', true],
|
|
['safari-web-extension://ABCDEF', true],
|
|
|
|
// No Origin (native clients, curl) is not a browser CSRF vector.
|
|
['', true],
|
|
[undefined as unknown as string, true],
|
|
|
|
// Malformed origins are rejected.
|
|
['not a url', false],
|
|
])('should decide pairing origin %s -> %s', (origin, expected) => {
|
|
expect(isAllowedPairingOrigin(origin)).toBe(expected);
|
|
});
|
|
});
|