passbolt-styleguide/src/react-extension/lib/Sanitize/sanitizeUrl.test.js

Passbolt styleguide contains common styling assets used by the different sites, plugin, etc.

import sanitizeUrl, {urlProtocols} from "./sanitizeUrl";

describe("Sanitize URL checks", () => {
  it("Baseline checks", () => {
    expect(sanitizeUrl()).toBe(false);
    expect(sanitizeUrl('')).toBe(false);
    expect(sanitizeUrl(null)).toBe(false);
    expect(sanitizeUrl(undefined)).toBe(false);
    expect(sanitizeUrl({})).toBe(false);
    expect(sanitizeUrl(1)).toBe(false);
    expect(sanitizeUrl('/home')).toBe(false);
    expect(sanitizeUrl('./home')).toBe(false);
    expect(sanitizeUrl('../home')).toBe(false);
    expect(sanitizeUrl('~/home')).toBe(false);
    expect(sanitizeUrl('\home')).toBe(false);
    expect(sanitizeUrl('\\home')).toBe(false);
    expect(sanitizeUrl('localhost/test')).toBe(false);
    expect(sanitizeUrl('passbolt.com')).toBe(false);
    expect(sanitizeUrl('127.0.0.1')).toBe(false);
    expect(sanitizeUrl('[::1]')).toBe(false);

    expect(sanitizeUrl('javascript:alert(1)')).toBe(false);
    expect(sanitizeUrl('ssh://localhost')).toBe(false);
    expect(sanitizeUrl('ftp://localhost')).toBe(false);

    expect(sanitizeUrl('http://localhost')).not.toBe(false);
    expect(sanitizeUrl('https://localhost')).not.toBe(false);
    expect(sanitizeUrl('https://1.1.1.1')).not.toBe(false);
    expect(sanitizeUrl('https://[::1]')).not.toBe(false);
    expect(sanitizeUrl('https://passbolt.com')).not.toBe(false);
    expect(sanitizeUrl('https://www.passbolt.com')).not.toBe(false);
    expect(sanitizeUrl('https://www.passbolt.com/test')).not.toBe(false);
  });


  it("White listed protocols option", () => {
    const whitelistedProtocols = ['ssh:', 'ftp:', 'javascript:'];

    expect(sanitizeUrl('javascript:alert(1)', {whitelistedProtocols})).toBe(false);

    expect(sanitizeUrl('ssh://localhost', {whitelistedProtocols})).not.toBe(false);
    expect(sanitizeUrl('ftp://localhost', {whitelistedProtocols})).not.toBe(false);

    expect(sanitizeUrl('http://passbolt.com', {whitelistedProtocols})).toBe(false);
    expect(sanitizeUrl('https://passbolt.com', {whitelistedProtocols})).toBe(false);
  });

  it("Default protocol option", () => {
    const defaultProtocol = urlProtocols.HTTPS;

    expect(sanitizeUrl('/home', {defaultProtocol})).toBe('https://home/');
    expect(sanitizeUrl('./home', {defaultProtocol})).toBe('https://./home');
    expect(sanitizeUrl('../home', {defaultProtocol})).toBe('https://../home');
    expect(sanitizeUrl('~/home', {defaultProtocol})).toBe('https://~/home');
    expect(sanitizeUrl('\home', {defaultProtocol})).toBe('https://home/');
    expect(sanitizeUrl('\\home', {defaultProtocol})).toBe('https://home/');
    expect(sanitizeUrl('localhost/test', {defaultProtocol})).toBe('https://localhost/test');
    expect(sanitizeUrl('127.0.0.1', {defaultProtocol})).toBe('https://127.0.0.1/');
    expect(sanitizeUrl('[::1]', {defaultProtocol})).toBe('https://[::1]/');
    expect(sanitizeUrl('http://127.0.0.1', {defaultProtocol})).toBe('http://127.0.0.1/');
  });
});