test/docsify
1
0
Fork 0
mirror of https://gitee.com/docsifyjs/docsify.git synced 2024-12-02 12:10:04 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix: isExternal check with malformed URL + tests (#1510)

Browse Source 
Fix #1477. Fix #1126. Follow-up to #1489.
This commit is contained in:
John Hildenbiddle 2021-02-18 06:06:44 -06:00 committed by GitHub
parent 6c13bdb7bd
commit ff2a66f127
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/core/fetch/index.js
View File

@ -22,7 +22,7 @@ function loadNested(path, qs, file, next, vm, first) {
function isExternal(url) {
let match = url.match(
/^([^:/?#]+:)?(?:\/\/([^/?#]*))?([^?#]+)?(\?[^#]*)?(#.*)?/
/^([^:/?#]+:)?(?:\/{2,}([^/?#]*))?([^?#]+)?(\?[^#]*)?(#.*)?/
);
if (
typeof match[1] === 'string' &&

32
test/e2e/security.test.js Normal file
View File

@ -0,0 +1,32 @@
const docsifyInit = require('../helpers/docsify-init');
describe(`Security`, function() {
const sharedOptions = {
markdown: {
homepage: '# Hello World',
},
routes: {
'test.md': '# Test Page',
},
};
describe(`Cross Site Scripting (XSS)`, function() {
const slashStrings = ['//', '///'];
for (const slashString of slashStrings) {
const hash = `#${slashString}domain.com/file.md`;
test(`should not load remote content from hash (${hash})`, async () => {
await docsifyInit(sharedOptions);
await expect(page).toHaveText('#main', 'Hello World');
await page.evaluate(() => (location.hash = '#/test'));
await expect(page).toHaveText('#main', 'Test Page');
await page.evaluate(newHash => {
location.hash = newHash;
}, hash);
await expect(page).toHaveText('#main', 'Hello World');
expect(page.url()).toMatch(/#\/$/);
});
}
});
});