49 lines
1.3 KiB
TypeScript
49 lines
1.3 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
captureTableView,
|
|
namedTableView,
|
|
tableViewPath,
|
|
} from "./table-view-state";
|
|
|
|
describe("saved table views", () => {
|
|
it("keeps filters and sorting but discards page and credentials", () => {
|
|
expect(
|
|
captureTableView(
|
|
"search=test&page=4&sort=id&order=asc&filter_rank=7&token=secret&redirect=https://evil.invalid",
|
|
["name"],
|
|
),
|
|
).toEqual({
|
|
params: { search: "test", sort: "id", order: "asc", filter_rank: "7" },
|
|
hidden: ["name"],
|
|
});
|
|
});
|
|
it("rejects external and traversal paths", () => {
|
|
for (const path of [
|
|
"https://evil.invalid/admin/users",
|
|
"/admin/../me",
|
|
"//admin/users",
|
|
"/me",
|
|
])
|
|
expect(tableViewPath.safeParse(path).success).toBe(false);
|
|
expect(tableViewPath.safeParse("/admin/tickets/desk").success).toBe(true);
|
|
});
|
|
it("rejects unsafe or oversized stored state", () => {
|
|
expect(
|
|
namedTableView.safeParse({
|
|
name: "Test",
|
|
state: { params: { password: "secret" }, hidden: [] },
|
|
}).success,
|
|
).toBe(false);
|
|
expect(
|
|
namedTableView.safeParse({ name: " ", state: { params: {}, hidden: [] } })
|
|
.success,
|
|
).toBe(false);
|
|
expect(
|
|
namedTableView.safeParse({
|
|
name: "Test",
|
|
state: { params: { search: "x".repeat(201) }, hidden: [] },
|
|
}).success,
|
|
).toBe(false);
|
|
});
|
|
});
|