Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/github-security.test.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { isPrivateAddress, validatedHttpsUrl } = require('../../src/github');
+const { CURATED_PAYLOAD_SOURCES } = require('../../src/services/payload-catalog-service');
+
+test('payload downloads reject private, credentialed and plaintext URLs', () => {
+  assert.equal(isPrivateAddress('192.168.1.105'), true);
+  assert.equal(isPrivateAddress('127.0.0.1'), true);
+  assert.equal(isPrivateAddress('8.8.8.8'), false);
+  assert.throws(() => validatedHttpsUrl('http://github.com/file.elf'), /HTTPS/);
+  assert.throws(() => validatedHttpsUrl('https://127.0.0.1/file.elf'), /Interne/);
+  assert.throws(() => validatedHttpsUrl('https://user:pass@example.com/file.elf'), /HTTPS/);
+  assert.equal(validatedHttpsUrl('https://github.com/etaHEN/etaHEN').hostname, 'github.com');
+});
+
+test('curated payload catalog uses unique public HTTPS repositories', () => {
+  assert.ok(CURATED_PAYLOAD_SOURCES.length >= 10);
+  const urls = CURATED_PAYLOAD_SOURCES.map(source => validatedHttpsUrl(source.github_url).href);
+  assert.equal(new Set(urls).size, urls.length);
+  assert.ok(CURATED_PAYLOAD_SOURCES.every(source => source.trust === 'official' && source.built_in === 1));
+});