Moheeb Zara
ef34089e57
Edge URLs like https:example.com parse to protocol https: but lack //, which the migration-050 CHECK rejects -- the admin would see a confusing save failure instead of a clear validation error. Require the prefix so the Zod boundary matches the data layer. Fail-closed either way; no security impact.
60 lines
2.2 KiB
TypeScript
60 lines
2.2 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import {
|
|
DUES_LINK_PLATFORMS,
|
|
DUES_PLATFORM_LABEL,
|
|
isDuesLinkPlatform,
|
|
isSafeDuesUrl,
|
|
} from '@/lib/dues-payments-logic'
|
|
|
|
describe('DUES_LINK_PLATFORMS', () => {
|
|
it('is the url-based subset, excluding cash and stripe', () => {
|
|
expect(DUES_LINK_PLATFORMS).toEqual(['paypal', 'zeffy', 'venmo'])
|
|
expect((DUES_LINK_PLATFORMS as readonly string[]).includes('cash')).toBe(false)
|
|
expect((DUES_LINK_PLATFORMS as readonly string[]).includes('stripe')).toBe(false)
|
|
})
|
|
|
|
it('has a label for every platform', () => {
|
|
for (const p of DUES_LINK_PLATFORMS) expect(DUES_PLATFORM_LABEL[p]).toBeTruthy()
|
|
})
|
|
})
|
|
|
|
describe('isDuesLinkPlatform', () => {
|
|
it('accepts the link platforms', () => {
|
|
expect(isDuesLinkPlatform('paypal')).toBe(true)
|
|
expect(isDuesLinkPlatform('venmo')).toBe(true)
|
|
})
|
|
it('rejects cash, stripe, and junk', () => {
|
|
expect(isDuesLinkPlatform('cash')).toBe(false)
|
|
expect(isDuesLinkPlatform('stripe')).toBe(false)
|
|
expect(isDuesLinkPlatform('bogus')).toBe(false)
|
|
})
|
|
})
|
|
|
|
describe('isSafeDuesUrl', () => {
|
|
it('accepts absolute https URLs', () => {
|
|
expect(isSafeDuesUrl('https://paypal.me/myspace')).toBe(true)
|
|
expect(isSafeDuesUrl('https://www.zeffy.com/en-US/donation-form/abc')).toBe(true)
|
|
})
|
|
it('rejects http (plaintext downgrade)', () => {
|
|
expect(isSafeDuesUrl('http://paypal.me/myspace')).toBe(false)
|
|
})
|
|
it('rejects javascript:, data:, and other schemes (XSS)', () => {
|
|
expect(isSafeDuesUrl('javascript:alert(1)')).toBe(false)
|
|
expect(isSafeDuesUrl('data:text/html,<script>')).toBe(false)
|
|
expect(isSafeDuesUrl('mailto:[email protected]')).toBe(false)
|
|
})
|
|
it('rejects relative or unparseable input', () => {
|
|
expect(isSafeDuesUrl('/paypal')).toBe(false)
|
|
expect(isSafeDuesUrl('paypal.me/x')).toBe(false)
|
|
expect(isSafeDuesUrl('')).toBe(false)
|
|
})
|
|
|
|
it('rejects https without // (stays in lockstep with the DB CHECK)', () => {
|
|
// these parse to protocol https: but lack the // the DB CHECK requires
|
|
expect(isSafeDuesUrl('https:example.com')).toBe(false)
|
|
expect(isSafeDuesUrl('https:/x')).toBe(false)
|
|
// bare scheme with no host
|
|
expect(isSafeDuesUrl('https://')).toBe(false)
|
|
})
|
|
})
|