mirror of
https://github.com/go-gitea/gitea.git
synced 2026-03-04 12:46:49 +01:00
315b947740
This PR hardens the handling of the “open-link” action in render iframes (external rendering iframes). It prevents iframes from triggering unsafe or unintended redirects or opening new windows via postMessage. Additionally, it improves iframe height reporting to reduce scrollbar and height mismatch issues, and adds unit test coverage. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
47 lines
1.7 KiB
TypeScript
47 lines
1.7 KiB
TypeScript
import {navigateToIframeLink} from './render-iframe.ts';
|
|
|
|
describe('navigateToIframeLink', () => {
|
|
const openSpy = vi.spyOn(window, 'open').mockImplementation(() => null);
|
|
const assignSpy = vi.spyOn(window.location, 'assign').mockImplementation(() => undefined);
|
|
|
|
test('safe links', () => {
|
|
navigateToIframeLink('http://example.com', '_blank');
|
|
expect(openSpy).toHaveBeenCalledWith('http://example.com/', '_blank', 'noopener,noreferrer');
|
|
vi.clearAllMocks();
|
|
|
|
navigateToIframeLink('https://example.com', '_self');
|
|
expect(assignSpy).toHaveBeenCalledWith('https://example.com/');
|
|
vi.clearAllMocks();
|
|
|
|
navigateToIframeLink('https://example.com', null);
|
|
expect(assignSpy).toHaveBeenCalledWith('https://example.com/');
|
|
vi.clearAllMocks();
|
|
|
|
navigateToIframeLink('/path', '');
|
|
expect(assignSpy).toHaveBeenCalledWith('http://localhost:3000/path');
|
|
vi.clearAllMocks();
|
|
|
|
// input can be any type & any value, keep the same behavior as `window.location.href = 0`
|
|
navigateToIframeLink(0, {});
|
|
expect(assignSpy).toHaveBeenCalledWith('http://localhost:3000/0');
|
|
vi.clearAllMocks();
|
|
});
|
|
|
|
test('unsafe links', () => {
|
|
window.location.href = 'http://localhost:3000/';
|
|
|
|
// eslint-disable-next-line no-script-url
|
|
navigateToIframeLink('javascript:void(0);', '_blank');
|
|
expect(openSpy).toHaveBeenCalledTimes(0);
|
|
expect(assignSpy).toHaveBeenCalledTimes(0);
|
|
expect(window.location.href).toBe('http://localhost:3000/');
|
|
vi.clearAllMocks();
|
|
|
|
navigateToIframeLink('data:image/svg+xml;utf8,<svg></svg>', '');
|
|
expect(openSpy).toHaveBeenCalledTimes(0);
|
|
expect(assignSpy).toHaveBeenCalledTimes(0);
|
|
expect(window.location.href).toBe('http://localhost:3000/');
|
|
vi.clearAllMocks();
|
|
});
|
|
});
|