Published source

CH-J Server Manager

Browse directories and files for a specific application release.

Source is provided under the CH-J Proprietary Software License 1.14. Its availability does not change the license terms or grant additional rights.

1,2 KB · 34 linesDownload file

1"use strict";

3const test = require("node:test");

4const assert = require("node:assert/strict");

5const { assertAllowedUrl, normalizeBaseUrl } = require("../src/main/security/urlPolicy");

7const bases = [

8 "https://sm.ch-j.de/"

9];

11test("base URL normalization preserves the allowed root", () => {

12 assert.equal(normalizeBaseUrl("https://sm.ch-j.de").toString(), bases[0]);

13});

15test("allowed API and file URLs pass", () => {

16 assert.equal(

17 assertAllowedUrl(`${bases[0]}api/latest.php`, bases, { pathSegment: "api/" }).hostname,

18 "sm.ch-j.de"

19 );

20 assert.equal(

21 assertAllowedUrl(`${bases[0]}files/apps/win/app.exe`, bases, { pathSegment: "files/" }).hostname,

22 "sm.ch-j.de"

23 );

24});

26test("foreign hosts, credentials and paths are rejected", () => {

27 assert.throws(() => assertAllowedUrl("https://example.com/update.exe", bases), /allowlist/);

28 assert.throws(() => assertAllowedUrl("https://admin@sm.ch-j.de/files/a", bases), /credentials/);

29 assert.throws(() => assertAllowedUrl(`${bases[0]}admin.php`, bases, { pathSegment: "files/" }), /path/);

30});

32test("HTTP update origins are rejected", () => {

33 assert.throws(() => normalizeBaseUrl("http://sm.ch-j.de/"), /HTTPS/);

34});

SHA-256: d76d344fc0a131fce6290b1ec7070dbd3c720cdd7b11a86e4330692f4056425b

Archive SHA-256: 5ac91caf4fa32a6fdb114f2430deed486fbe7489d5eea343d1f034169fafb5e0