view_components/test/lib/safe_href_helper_test.rb at 534698a16beddefafe8eede04bfd36b510dcba8f · primer/view_components · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
# frozen_string_literal: true

require "lib/test_helper"

class Primer::SafeHrefHelperTest < Minitest::Test
  include Primer::SafeHrefHelper

  def test_returns_false_for_nil
    refute Primer::SafeHrefHelper.unsafe_href?(nil)
  end

  def test_returns_false_for_relative_paths
    refute Primer::SafeHrefHelper.unsafe_href?("/foo/bar")
    refute Primer::SafeHrefHelper.unsafe_href?("foo/bar")
    refute Primer::SafeHrefHelper.unsafe_href?("#anchor")
    refute Primer::SafeHrefHelper.unsafe_href?("?query=1")
    refute Primer::SafeHrefHelper.unsafe_href?("")
  end

  def test_returns_false_for_safe_schemes
    refute Primer::SafeHrefHelper.unsafe_href?("https://example.com")
    refute Primer::SafeHrefHelper.unsafe_href?("http://example.com")
    refute Primer::SafeHrefHelper.unsafe_href?("mailto:foo@example.com")
    refute Primer::SafeHrefHelper.unsafe_href?("ftp://example.com")
    refute Primer::SafeHrefHelper.unsafe_href?("tel:+15551234567")
    refute Primer::SafeHrefHelper.unsafe_href?("data:image/png;base64,abc")
  end

  def test_detects_javascript_uri
    assert Primer::SafeHrefHelper.unsafe_href?("javascript:alert(1)")
  end

  def test_detects_vbscript_uri
    assert Primer::SafeHrefHelper.unsafe_href?("vbscript:msgbox(1)")
  end

  def test_detects_mixed_case_schemes
    assert Primer::SafeHrefHelper.unsafe_href?("JaVaScRiPt:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("JAVASCRIPT:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("VbScript:alert(1)")
  end

  def test_detects_leading_whitespace_bypasses
    assert Primer::SafeHrefHelper.unsafe_href?(" javascript:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("\tjavascript:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("\njavascript:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("\rjavascript:alert(1)")
  end

  def test_detects_embedded_whitespace_and_control_chars_in_scheme
    # Browsers strip tab/CR/LF inside URLs per the WHATWG URL spec, so these execute.
    assert Primer::SafeHrefHelper.unsafe_href?("java\tscript:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("java\nscript:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("java\rscript:alert(1)")
    assert Primer::SafeHrefHelper.unsafe_href?("j\u0000avascript:alert(1)")
  end

  def test_does_not_misclassify_schemes_that_merely_contain_javascript
    refute Primer::SafeHrefHelper.unsafe_href?("https://example.com/javascript:foo")
    refute Primer::SafeHrefHelper.unsafe_href?("/javascript:foo")
  end

  def test_handles_non_string_values
    refute Primer::SafeHrefHelper.unsafe_href?(123)
    refute Primer::SafeHrefHelper.unsafe_href?(:foo)
  end

  def test_instance_method_delegates_to_module_method
    assert unsafe_href?("javascript:alert(1)")
    refute unsafe_href?("https://example.com")
  end
end