mirror of
https://github.com/jason5ng32/MyIP.git
synced 2026-11-04 08:55:47 +00:00
jason5ng32andClaude Opus 5.5
c29e48687b
common/ had become the backend's library: 30 of its 41 modules were imported by nothing in the frontend, so the name no longer said what belonged there. It now holds only what the frontend or the build imports too; backend-only code moved to server/, flat except for datasets/ (the dataset engine and its readers). The *-db/ dataset directories stay in common/: self-hosting docs and Docker volumes mount those paths. frontend/utils/ keeps its app-wide modules at the root and gains ip/ (IP / ASN shaping and validation), report/ (the report pipeline) and features/ (the pure layer of a single feature). Paths only — no logic changes. The Dockerfile copies server/, and the AGENTS.md files say where a new module goes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
87 lines
3.3 KiB
JavaScript
87 lines
3.3 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { describe, it, afterEach, beforeEach } from 'node:test';
|
|
|
|
import { refererCheck } from '../server/referer-check.js';
|
|
|
|
// backup ALLOWED_DOMAINS before each test, restore after each test
|
|
let backup;
|
|
beforeEach(() => { backup = process.env.ALLOWED_DOMAINS; });
|
|
afterEach(() => {
|
|
if (backup === undefined) delete process.env.ALLOWED_DOMAINS;
|
|
else process.env.ALLOWED_DOMAINS = backup;
|
|
});
|
|
|
|
describe('refererCheck — base cases', () => {
|
|
it('returns false for missing referer', () => {
|
|
assert.equal(refererCheck(), false);
|
|
assert.equal(refererCheck(undefined), false);
|
|
assert.equal(refererCheck(null), false);
|
|
});
|
|
|
|
it('returns false for empty string referer', () => {
|
|
// Falsy short-circuit: not a URL parse attempt, just false
|
|
assert.equal(refererCheck(''), false);
|
|
});
|
|
|
|
it('always whitelists localhost regardless of ALLOWED_DOMAINS', () => {
|
|
delete process.env.ALLOWED_DOMAINS;
|
|
assert.equal(refererCheck('http://localhost/'), true);
|
|
assert.equal(refererCheck('http://localhost:5173/tools'), true);
|
|
assert.equal(refererCheck('https://localhost:443/'), true);
|
|
});
|
|
});
|
|
|
|
describe('refererCheck — ALLOWED_DOMAINS parsing', () => {
|
|
it('accepts a single configured domain', () => {
|
|
process.env.ALLOWED_DOMAINS = 'example.com';
|
|
assert.equal(refererCheck('https://example.com/'), true);
|
|
assert.equal(refererCheck('https://example.com/sub/path?q=1'), true);
|
|
});
|
|
|
|
it('accepts any of several comma-separated domains', () => {
|
|
process.env.ALLOWED_DOMAINS = 'a.com,b.net,c.org';
|
|
assert.equal(refererCheck('https://a.com/'), true);
|
|
assert.equal(refererCheck('https://b.net/'), true);
|
|
assert.equal(refererCheck('https://c.org/'), true);
|
|
});
|
|
|
|
it('rejects subdomains that are not explicitly listed', () => {
|
|
// Current implementation uses exact hostname match, not suffix match
|
|
process.env.ALLOWED_DOMAINS = 'example.com';
|
|
assert.equal(refererCheck('https://sub.example.com/'), false);
|
|
});
|
|
|
|
it('rejects look-alike / unknown domains', () => {
|
|
process.env.ALLOWED_DOMAINS = 'example.com';
|
|
assert.equal(refererCheck('https://example.net/'), false);
|
|
assert.equal(refererCheck('https://evil.example.com.attacker.xyz/'), false);
|
|
});
|
|
|
|
it('trims URL properly (hostname extraction ignores port, path, query)', () => {
|
|
process.env.ALLOWED_DOMAINS = 'example.com';
|
|
assert.equal(refererCheck('https://example.com:8443/deep/path?x=1#frag'), true);
|
|
});
|
|
|
|
it('treats unset ALLOWED_DOMAINS as "only localhost allowed"', () => {
|
|
delete process.env.ALLOWED_DOMAINS;
|
|
assert.equal(refererCheck('https://example.com/'), false);
|
|
assert.equal(refererCheck('http://localhost/'), true);
|
|
});
|
|
|
|
it('empty ALLOWED_DOMAINS still permits localhost', () => {
|
|
process.env.ALLOWED_DOMAINS = '';
|
|
assert.equal(refererCheck('http://localhost/'), true);
|
|
assert.equal(refererCheck('https://example.com/'), false);
|
|
});
|
|
});
|
|
|
|
describe('refererCheck — malformed inputs', () => {
|
|
it('returns false on non-URL strings instead of throwing', () => {
|
|
// Scanners send garbage Referer headers; parse failure means denial,
|
|
// not an exception bubbling up to a 500.
|
|
assert.equal(refererCheck('not-a-url'), false);
|
|
assert.equal(refererCheck('http://'), false);
|
|
assert.equal(refererCheck('%%%'), false);
|
|
});
|
|
});
|