openhands
1875a69b83
- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts - Add 'secure' attribute to locale cookie in language-switcher.tsx - Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention) - Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention) - Document intentional MD5 usage for legacy PHP compatibility in password.ts - Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts
28 lines
869 B
TypeScript
28 lines
869 B
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { generateTotp, generateTotpSecret, totpKeyUri, verifyTotp } from "./totp";
|
|
|
|
const SECRET = generateTotpSecret();
|
|
|
|
describe("totp", () => {
|
|
it("verifies the current generated code", () => {
|
|
const code = generateTotp(SECRET);
|
|
expect(code).toMatch(/^\d{6}$/);
|
|
expect(verifyTotp(code, SECRET)).toBe(true);
|
|
});
|
|
|
|
it("rejects a wrong code", () => {
|
|
expect(verifyTotp("000000", SECRET)).toBe(false);
|
|
});
|
|
|
|
it("rejects malformed input without throwing", () => {
|
|
expect(verifyTotp("not-a-code", SECRET)).toBe(false);
|
|
});
|
|
|
|
it("builds an otpauth provisioning URI", () => {
|
|
const uri = totpKeyUri(SECRET, "alice", "AtomHotel");
|
|
expect(uri.startsWith("otpauth://totp/")).toBe(true);
|
|
expect(uri).toContain("secret=" + SECRET);
|
|
expect(uri).toContain("issuer=AtomHotel");
|
|
});
|
|
});
|