alisaza
76e65f4f79
- Added a new line for better readability in the BankAccountsPage component when showing alert messages. - Refactored the test case for isRequestHostAllowed to enhance clarity. - Improved formatting in the CreateBankAccountFormValidation schema for the nationalCode field.
48 lines
1.7 KiB
TypeScript
48 lines
1.7 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import { isRequestHostAllowed } from '@/lib/security/requestHost'
|
|
|
|
describe('isRequestHostAllowed', () => {
|
|
it.each(['backoffice.ghabilee.ir', 'backoffice.ghabilee.ir:443', 'BACKOFFICE.GHABILEE.IR'])(
|
|
'allows a canonical production host: %s',
|
|
(host) => {
|
|
expect(isRequestHostAllowed(host, 'production')).toBe(true)
|
|
}
|
|
)
|
|
|
|
it.each([
|
|
null,
|
|
'',
|
|
'ghabilee.ir',
|
|
'www.ghabilee.ir',
|
|
'dev.ghabilee.ir',
|
|
'arashmohammadi.com',
|
|
'backoffice.ghabilee.ir.attacker.example',
|
|
'backoffice.ghabilee.ir@attacker.example',
|
|
'backoffice.ghabilee.ir/path',
|
|
'backoffice.ghabilee.ir, attacker.example',
|
|
'backoffice.ghabilee.ir:65536',
|
|
])('rejects an untrusted or malformed production host: %s', (host) => {
|
|
expect(isRequestHostAllowed(host, 'production')).toBe(false)
|
|
})
|
|
|
|
it('does not block local development hosts', () => {
|
|
expect(isRequestHostAllowed('127.0.0.1:3008', 'development')).toBe(true)
|
|
expect(isRequestHostAllowed('localhost:3008', 'test')).toBe(true)
|
|
})
|
|
|
|
it('allows loopback hosts in production only when ALLOW_LOCAL_REQUEST_HOSTS is set', () => {
|
|
const previous = process.env.ALLOW_LOCAL_REQUEST_HOSTS
|
|
|
|
delete process.env.ALLOW_LOCAL_REQUEST_HOSTS
|
|
expect(isRequestHostAllowed('127.0.0.1:3102', 'production')).toBe(false)
|
|
|
|
process.env.ALLOW_LOCAL_REQUEST_HOSTS = '1'
|
|
expect(isRequestHostAllowed('127.0.0.1:3102', 'production')).toBe(true)
|
|
expect(isRequestHostAllowed('localhost:3102', 'production')).toBe(true)
|
|
|
|
if (previous === undefined) delete process.env.ALLOW_LOCAL_REQUEST_HOSTS
|
|
else process.env.ALLOW_LOCAL_REQUEST_HOSTS = previous
|
|
})
|
|
})
|