Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/payload-manager-proxy.test.js

@@ -0,0 +1,33 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  PREFIX,
+  allowedRemoteRoute,
+  rewritePayloadManagerHtml,
+} = require('../../src/server/payload-manager-proxy');
+
+test('Payload Manager proxy only admits the supported UI and API routes', () => {
+  assert.equal(allowedRemoteRoute('/'), true);
+  assert.equal(allowedRemoteRoute('/list_payloads'), true);
+  assert.equal(allowedRemoteRoute('/manage:upload'), true);
+  assert.equal(allowedRemoteRoute('/loadpayload:/data/payloads/etaHEN.bin'), false);
+  assert.equal(allowedRemoteRoute('/processes_list'), true);
+  assert.equal(allowedRemoteRoute('/process_kill'), false);
+  assert.equal(allowedRemoteRoute('/process_kill?pid=42'), false);
+  assert.equal(allowedRemoteRoute('/shutdown'), false);
+  assert.equal(allowedRemoteRoute('/api/auth/status'), false);
+  assert.equal(allowedRemoteRoute('/../secrets'), false);
+  assert.equal(allowedRemoteRoute('//example.test'), false);
+});
+
+test('Payload Manager single-file UI is rewritten to its isolated token route', () => {
+  const base = `${PREFIX}/t/${'a'.repeat(43)}`;
+  const input = '<html manifest="/cache.appcache"><link href="/favicon.svg"><script>fetch(`/list_payloads`);new EventSource(\'/events\')</script></html>';
+  const output = rewritePayloadManagerHtml(input, base);
+  assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/cache\\.appcache`));
+  assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/list_payloads`));
+  assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/events`));
+  assert.doesNotMatch(output, /fetch\(`\/list_payloads/);
+});