From eaace6ada4eee56bb64c98a3e2c6b7b46b8d8ec3 Mon Sep 17 00:00:00 2001 From: Maurice Date: Sun, 6 Sep 2026 14:32:53 +0200 Subject: [PATCH] fix(test): assert the untouched GET properly toMatchObject({ method: undefined }) does not say what it looks like it says. --- server/tests/unit/utils/ssrfGuard.test.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/server/tests/unit/utils/ssrfGuard.test.ts b/server/tests/unit/utils/ssrfGuard.test.ts index ad4f0ef0d..f75600a0f 100644 --- a/server/tests/unit/utils/ssrfGuard.test.ts +++ b/server/tests/unit/utils/ssrfGuard.test.ts @@ -431,7 +431,10 @@ describe('safeFetchFollow (manual per-hop redirect SSRF)', () => { it('leaves a GET alone on a 301', async () => { const mockFetch = twoHops('https://start.example/b', 301); await safeFetchFollow('https://start.example/a', { headers: { 'User-Agent': 'TREK' } }); - expect(mockFetch.mock.calls[1][1]).toMatchObject({ method: undefined }); + // No downgrade to apply: the request was already a GET, so the init keeps + // its shape and the caller's own header rides along. + expect((mockFetch.mock.calls[1][1] as RequestInit).method).toBeUndefined(); + expect((mockFetch.mock.calls[1][1] as RequestInit).body).toBeUndefined(); expect(headerOf(mockFetch.mock.calls[1], 'user-agent')).toBe('TREK'); });