34 lines
1.6 KiB
JavaScript
34 lines
1.6 KiB
JavaScript
'use strict';
|
|
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const {
|
|
PREFIX,
|
|
allowedRemoteRoute,
|
|
rewritePayloadManagerHtml,
|
|
} = require('../../src/server/payload-manager-proxy');
|
|
|
|
test('Payload Manager proxy only admits the supported UI and API routes', () => {
|
|
assert.equal(allowedRemoteRoute('/'), true);
|
|
assert.equal(allowedRemoteRoute('/list_payloads'), true);
|
|
assert.equal(allowedRemoteRoute('/manage:upload'), true);
|
|
assert.equal(allowedRemoteRoute('/loadpayload:/data/payloads/etaHEN.bin'), false);
|
|
assert.equal(allowedRemoteRoute('/processes_list'), true);
|
|
assert.equal(allowedRemoteRoute('/process_kill'), false);
|
|
assert.equal(allowedRemoteRoute('/process_kill?pid=42'), false);
|
|
assert.equal(allowedRemoteRoute('/shutdown'), false);
|
|
assert.equal(allowedRemoteRoute('/api/auth/status'), false);
|
|
assert.equal(allowedRemoteRoute('/../secrets'), false);
|
|
assert.equal(allowedRemoteRoute('//example.test'), false);
|
|
});
|
|
|
|
test('Payload Manager single-file UI is rewritten to its isolated token route', () => {
|
|
const base = `${PREFIX}/t/${'a'.repeat(43)}`;
|
|
const input = '<html manifest="/cache.appcache"><link href="/favicon.svg"><script>fetch(`/list_payloads`);new EventSource(\'/events\')</script></html>';
|
|
const output = rewritePayloadManagerHtml(input, base);
|
|
assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/cache\\.appcache`));
|
|
assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/list_payloads`));
|
|
assert.match(output, new RegExp(`${base.replace(/\//g, '\\/')}\\/events`));
|
|
assert.doesNotMatch(output, /fetch\(`\/list_payloads/);
|
|
});
|