mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-21 14:36:31 +00:00
Maurice
2350c3ae14
A place from the TREK index can carry its website the way Overture has it, such as fr.wikipedia.org/wiki/Chapelle_Sainte-Barbe_du_Faouët, and saving it to a collection or a trip failed with "website must be an http or https URL" over a field the dialog does not show (#2483). OpenStreetMap, Amap and booking mails hand over websites the same way. Every place a website comes in from outside now goes through one shared helper, normalizePlaceWebsite: the index client and its nearby search, the Overpass and OSM detail mappers, Google search and details, Amap, plugin search and the booking import. It completes a bare or protocol-relative host to https, keeps http and https as they are, and drops every other scheme and anything that is no address. Only the scheme is added, so an accented path is stored as written. placeWebsiteSchema completes a bare host the same way before its check, so an older client, a cached offline result, an MCP agent or a plugin is no longer refused, while javascript:, data: and mailto: still are. The REST controller, the plugin RPC and the enrichment now store the parsed value instead of the raw one, and create_place_accommodation takes the website through the same schema as create_place. safeHttpUrl still links only a value already stored in its final form, so nothing changes on screen. Tests: SHARED-WEBSITE-001 to 012, SHARED-PLACE-030 to 034, SHARED-COLLFILE-2483-01, COLLECTIONS-E2E-089 and 090, PLACES-E2E-2483-01 and 02, PLACES-CTRL-2483-01 (the louvre.fr case adjusted), MCP-PLACES-2483-01 to 03, MCP-ACCOM-2483-01, MCP-COLL-2483-01, PLACES-RPC-2483-01, MAPS-2483-01 to 05, MAPS-POIS-015, MAPS-GERS-010, AMAP-012b, TREK-PLACES-2483-01, PLUGIN-SEARCH-2483-01, BOOKING-IMPORT-2483-01, ENRICH-052e, ENRICH-102 extended, ENRICH-120 adjusted, FE-UTIL-SAFEURL-007.
44 lines
2.0 KiB
TypeScript
44 lines
2.0 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import { safeHttpUrl } from './safeUrl'
|
|
|
|
describe('safeHttpUrl', () => {
|
|
it('FE-UTIL-SAFEURL-001: passes an ordinary https homepage through', () => {
|
|
expect(safeHttpUrl('https://louvre.fr/en/visit')).toBe('https://louvre.fr/en/visit')
|
|
})
|
|
|
|
it('FE-UTIL-SAFEURL-002: passes plain http through — plenty of small venues still run it', () => {
|
|
expect(safeHttpUrl('http://pension-alpenblick.at')).toBe('http://pension-alpenblick.at')
|
|
})
|
|
|
|
it('FE-UTIL-SAFEURL-003: rejects javascript:, which window.open would run in this origin', () => {
|
|
expect(safeHttpUrl('javascript:fetch("/api/trips")')).toBeNull()
|
|
expect(safeHttpUrl('JavaScript:alert(1)')).toBeNull()
|
|
expect(safeHttpUrl(' javascript:alert(1)')).toBeNull()
|
|
})
|
|
|
|
it('FE-UTIL-SAFEURL-004: rejects the other schemes that are not a web page', () => {
|
|
expect(safeHttpUrl('data:text/html,<script>alert(1)</script>')).toBeNull()
|
|
expect(safeHttpUrl('vbscript:msgbox(1)')).toBeNull()
|
|
expect(safeHttpUrl('file:///etc/passwd')).toBeNull()
|
|
})
|
|
|
|
it('FE-UTIL-SAFEURL-005: rejects a bare host, since window.open would treat it as a relative path', () => {
|
|
expect(safeHttpUrl('louvre.fr')).toBeNull()
|
|
expect(safeHttpUrl('//evil.example')).toBeNull()
|
|
})
|
|
|
|
// #2483: the write contract now completes a bare host to https. What is read
|
|
// back here is the stored text, which is linked only when it is already final.
|
|
it('FE-UTIL-SAFEURL-007: a value the contract would complete is still not linked as stored', () => {
|
|
expect(safeHttpUrl('fr.wikipedia.org/wiki/Chapelle_Sainte-Barbe_du_Faouët')).toBeNull()
|
|
expect(safeHttpUrl(' https://louvre.fr')).toBeNull()
|
|
expect(safeHttpUrl('https://louvre.fr ')).toBe('https://louvre.fr ')
|
|
})
|
|
|
|
it('FE-UTIL-SAFEURL-006: treats absent and empty as nothing to open', () => {
|
|
expect(safeHttpUrl(null)).toBeNull()
|
|
expect(safeHttpUrl(undefined)).toBeNull()
|
|
expect(safeHttpUrl('')).toBeNull()
|
|
})
|
|
})
|