| Initial import of the rickub CLI as a standalone public project 1a1d430 Olivier Girardot 9h ago | 1 | package cmd |
| 2 | |
| 3 | import ( |
| 4 | "strings" |
| 5 | "testing" |
| 6 | ) |
| 7 | |
| 8 | // redact must not reveal any secret material — only the non-secret prefix that |
| 9 | // identifies the credential type. |
| 10 | func TestRedactRevealsNoSecretMaterial(t *testing.T) { |
| 11 | const secret = "rickub_pat_S3CRETMATERIAL" |
| 12 | got := redact(secret) |
| 13 | if got != "rickub_pat_…" { |
| 14 | t.Errorf("redact = %q, want %q", got, "rickub_pat_…") |
| 15 | } |
| 16 | if rest := strings.TrimPrefix(secret, tokenPrefix); strings.Contains(got, rest[:1]) { |
| 17 | t.Errorf("redact leaked secret material: %q", got) |
| 18 | } |
| 19 | if got := redact("short"); got != "****" { |
| 20 | t.Errorf("redact(non-PAT) = %q, want ****", got) |
| 21 | } |
| 22 | if got := redact(""); got != "****" { |
| 23 | t.Errorf("redact(empty) = %q, want ****", got) |
| 24 | } |
| 25 | } |
| 26 | |
| 27 | // A URL handed to the platform opener must be a plain web address: the opener |
| 28 | // launches whatever handler is registered for a scheme. |
| 29 | func TestCheckBrowserURLRejectsNonWebSchemes(t *testing.T) { |
| 30 | ok := []string{ |
| 31 | "https://rickub.com/login/device?code=ABCD", |
| 32 | "http://localhost:3000/login/device", |
| 33 | } |
| 34 | for _, u := range ok { |
| 35 | if err := checkBrowserURL(u); err != nil { |
| 36 | t.Errorf("checkBrowserURL(%q) = %v, want nil", u, err) |
| 37 | } |
| 38 | } |
| 39 | |
| 40 | bad := []string{ |
| 41 | "file:///etc/passwd", |
| 42 | "javascript:alert(1)", |
| 43 | "data:text/html,<script>alert(1)</script>", |
| 44 | "ssh://evil.example/x", |
| 45 | "vscode://evil", |
| 46 | "/login/device", |
| 47 | "https://", |
| 48 | "", |
| 49 | "ht tp://bad", |
| 50 | } |
| 51 | for _, u := range bad { |
| 52 | if err := checkBrowserURL(u); err == nil { |
| 53 | t.Errorf("checkBrowserURL(%q) = nil, want an error", u) |
| 54 | } |
| 55 | } |
| 56 | } |