Nick SzaunigandClaude Sonnet 5
154b75e0d8
Keine der in dieser Session neu hinzugefuegten sicherheitskritischen Module (lib/csrf.ts, lib/entra.ts, lib/dhl.ts) hatte bisher Tests. - csrf.test.ts: Same-Origin-Erkennung, Ablehnung gefaelschter Cross-Origin-Requests, tolerantes Verhalten bei fehlendem/kaputtem Origin-Header. - entra.test.ts: PKCE-Paar-Erzeugung (RFC 7636), Authorize-URL-Aufbau, Extraktion des verifizierten E-Mail-Claims (nie ein unplausibles Feld raten). - dhl.test.ts: Adress-Mapping (Strasse/Hausnummer-Trennung, ISO2->ISO3-Laendercode), Fehlerbehandlung bei nicht unterstuetztem Land, DHL-Validierungsfehlern und HTTP-Fehlern, statt einen falschen Erfolg vorzutaeuschen. Alle 118 Tests (13 Dateien) gruen, tsc --noEmit clean. Co-Authored-By: Claude Sonnet 5 <[email protected]>
41 lines
1.7 KiB
TypeScript
41 lines
1.7 KiB
TypeScript
import { describe, test, expect } from "vitest";
|
|
import { isTrustedOrigin } from "./csrf";
|
|
|
|
function makeRequest(url: string, origin?: string): Request {
|
|
const headers = new Headers();
|
|
if (origin !== undefined) headers.set("origin", origin);
|
|
return new Request(url, { method: "POST", headers });
|
|
}
|
|
|
|
describe("isTrustedOrigin", () => {
|
|
test("accepts a same-origin request", () => {
|
|
const request = makeRequest("https://wabenhain.com/api/checkout", "https://wabenhain.com");
|
|
expect(isTrustedOrigin(request)).toBe(true);
|
|
});
|
|
|
|
test("accepts a same-origin request even with an explicit default port in the URL", () => {
|
|
const request = makeRequest("https://wabenhain.com:443/api/checkout", "https://wabenhain.com");
|
|
expect(isTrustedOrigin(request)).toBe(true);
|
|
});
|
|
|
|
test("rejects a cross-origin request (forged CSRF attempt)", () => {
|
|
const request = makeRequest("https://wabenhain.com/api/checkout", "https://attacker.example");
|
|
expect(isTrustedOrigin(request)).toBe(false);
|
|
});
|
|
|
|
test("rejects a cross-origin request even from a similarly named host", () => {
|
|
const request = makeRequest("https://wabenhain.com/api/checkout", "https://wabenhain.com.attacker.example");
|
|
expect(isTrustedOrigin(request)).toBe(false);
|
|
});
|
|
|
|
test("rejects a malformed Origin header instead of throwing", () => {
|
|
const request = makeRequest("https://wabenhain.com/api/checkout", "not-a-valid-url");
|
|
expect(isTrustedOrigin(request)).toBe(false);
|
|
});
|
|
|
|
test("allows a request with no Origin header (e.g. server-to-server calls)", () => {
|
|
const request = makeRequest("https://wabenhain.com/api/checkout");
|
|
expect(isTrustedOrigin(request)).toBe(true);
|
|
});
|
|
});
|