yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(api): match the bunny host instead of a substring of the url

Browse Source 
CodeQL flags the substring form (js/incomplete-url-substring-sanitization)
because a host check on an unparsed url matches when the host appears
anywhere in it. Nothing untrusted reaches this recorder, but a loose
match could still record a delete aimed elsewhere as a Bunny delete and
pass an assertion for the wrong reason.
This commit is contained in:
yusufipk
2026-07-30 19:33:19 +07:00
parent 38d829597a
commit 733ac43172
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/api/expired-billing-cleanup.test.ts
+8 -4
View File
@@ -27,12 +27,16 @@ beforeEach(() => {
vi.stubGlobal( vi.stubGlobal(
'fetch', 'fetch',
vi.fn(async (url: string | URL, init?: { method?: string }) => { vi.fn(async (url: string | URL, init?: { method?: string }) => {
const href = typeof url === 'string' ? url : url.toString(); // Matched on the parsed host rather than a substring of the href, so a request to some
if (init?.method === 'DELETE' && href.includes('video.bunnycdn.com')) { // other service that merely mentions the Bunny host cannot be recorded as a Bunny
bunnyDeletes.push(href.split('/videos/')[1] ?? ''); // delete. The recorder decides what the assertions see, so a loose match here would
// make a test pass for the wrong reason.
const target = new URL(typeof url === 'string' ? url : url.toString());
if (init?.method === 'DELETE' && target.host === 'video.bunnycdn.com') {
bunnyDeletes.push(target.pathname.split('/videos/')[1] ?? '');
return new Response(null, { status: 200 }); return new Response(null, { status: 200 });
} }
throw new Error(`Unexpected fetch in test: ${init?.method ?? 'GET'} ${href}`); throw new Error(`Unexpected fetch in test: ${init?.method ?? 'GET'} ${target.href}`);
}) })
); );
}); });