27 lines
950 B
Go
27 lines
950 B
Go
|
package localaccess
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net/http"
|
||
|
|
"net/http/httptest"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestNativeAndCursorOriginsAllowedUnrelatedPagesRejected(t *testing.T) {
|
||
|
|
for _, origin := range []string{"", "vscode-file://vscode-app", "vscode-webview://fixture", "wails://wails", "http://127.0.0.1:9245", "https://api2.cursor.sh", "https://www.cursor.com"} {
|
||
|
|
if !AllowedOrigin(origin) {
|
||
|
|
t.Errorf("rejected %q", origin)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
for _, origin := range []string{"null", "https://evil.invalid", "https://api2.cursor.sh.evil.invalid", "https://api2.cursor.sh@evil.invalid", "file:///tmp/evil.html"} {
|
||
|
|
called := false
|
||
|
|
handler := Wrap(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { called = true }))
|
||
|
|
r := httptest.NewRequest(http.MethodPost, "http://127.0.0.1/rpc", nil)
|
||
|
|
r.Header.Set("Origin", origin)
|
||
|
|
w := httptest.NewRecorder()
|
||
|
|
handler.ServeHTTP(w, r)
|
||
|
|
if w.Code != 403 || called {
|
||
|
|
t.Errorf("origin %q reached backend", origin)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|