Files
chimera-Public/test/server/dependency-security-regressions.test.js
T

36 lines
1.6 KiB
JavaScript

'use strict';
const assert = require('node:assert/strict');
const test = require('node:test');
const uri = require('fast-uri');
const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
const yaml = require('js-yaml');
test('build dependency rejects malformed IPv6 instead of changing its destination', () => {
assert.ok(uri.parse('http://[::not-valid]/example').error);
assert.equal(uri.parse('https://example.com/path').host, 'example.com');
});
test('build XML dependency rejects invalid entity names at creation and strict serialization', () => {
const document = new DOMImplementation().createDocument(null, 'example', null);
const serializer = new XMLSerializer();
assert.throws(() => document.createEntityReference('bad; <element/> &suffix'));
const reference = document.createEntityReference('valid');
// xmldom 0.8 exposes strict serialization as the fourth argument.
assert.equal(serializer.serializeToString(reference, false, undefined, { requireWellFormed: true }), '&valid;');
reference.nodeName = 'bad; <element/> &suffix';
assert.throws(() => serializer.serializeToString(reference, false, undefined, { requireWellFormed: true }));
});
test('build YAML dependency counts empty merge sources against the work budget', () => {
const hostile = 'sources: &sources [{}, {}]\ntarget:\n <<: *sources\n';
assert.throws(
() => yaml.load(hostile, { schema: yaml.YAML11_SCHEMA, maxTotalMergeKeys: 1 }),
/merge keys exceeded maxTotalMergeKeys \(1\)/,
);
assert.deepEqual(yaml.load('base: &base { enabled: true }\ntarget:\n <<: *base\n'), {
base: { enabled: true },
target: { enabled: true },
});
});