Oskar Otwinowski
9b21f8d322
Vercel integration Desc + Vid coming soon For human reviewer: - check the db schema - check if posthog user attribution call is correct (telemetry.server.ts & `referralSource`) <!-- devin-review-badge-begin --> --- <a href="https://app.devin.ai/review/triggerdotdev/trigger.dev/pull/2994" target="_blank"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1"> <img src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1" alt="Open with Devin"> </picture> </a> <!-- devin-review-badge-end -->
57 lines
1.9 KiB
TypeScript
57 lines
1.9 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { sanitizeVercelNextUrl } from "../app/v3/vercel/vercelUrls.server";
|
|
|
|
describe("sanitizeVercelNextUrl", () => {
|
|
it("returns undefined for null/undefined/empty", () => {
|
|
expect(sanitizeVercelNextUrl(null)).toBeUndefined();
|
|
expect(sanitizeVercelNextUrl(undefined)).toBeUndefined();
|
|
expect(sanitizeVercelNextUrl("")).toBeUndefined();
|
|
});
|
|
|
|
it("allows relative paths", () => {
|
|
expect(sanitizeVercelNextUrl("/dashboard")).toBe("/dashboard");
|
|
expect(sanitizeVercelNextUrl("/some/path?query=1")).toBe("/some/path?query=1");
|
|
});
|
|
|
|
it("rejects protocol-relative URLs", () => {
|
|
expect(sanitizeVercelNextUrl("//evil.com/path")).toBeUndefined();
|
|
});
|
|
|
|
it("allows vercel.com URLs", () => {
|
|
expect(sanitizeVercelNextUrl("https://vercel.com/dashboard")).toBe(
|
|
"https://vercel.com/dashboard"
|
|
);
|
|
expect(sanitizeVercelNextUrl("https://app.vercel.com/settings")).toBe(
|
|
"https://app.vercel.com/settings"
|
|
);
|
|
});
|
|
|
|
it("allows vercel.com subdomains", () => {
|
|
expect(sanitizeVercelNextUrl("https://my-team.vercel.com/project")).toBe(
|
|
"https://my-team.vercel.com/project"
|
|
);
|
|
});
|
|
|
|
it("rejects non-vercel HTTPS URLs", () => {
|
|
expect(sanitizeVercelNextUrl("https://evil.com/path")).toBeUndefined();
|
|
expect(sanitizeVercelNextUrl("https://not-vercel.com")).toBeUndefined();
|
|
expect(sanitizeVercelNextUrl("https://vercel.com.evil.com")).toBeUndefined();
|
|
});
|
|
|
|
it("rejects HTTP vercel.com URLs", () => {
|
|
expect(sanitizeVercelNextUrl("http://vercel.com/dashboard")).toBeUndefined();
|
|
});
|
|
|
|
it("rejects javascript: URLs", () => {
|
|
expect(sanitizeVercelNextUrl("javascript:alert(1)")).toBeUndefined();
|
|
});
|
|
|
|
it("rejects data: URLs", () => {
|
|
expect(sanitizeVercelNextUrl("data:text/html,<script>alert(1)</script>")).toBeUndefined();
|
|
});
|
|
|
|
it("rejects invalid URLs", () => {
|
|
expect(sanitizeVercelNextUrl("not a url at all")).toBeUndefined();
|
|
});
|
|
});
|