CalvinBackup/anonymous_github
1
0
Fork 0
mirror of https://github.com/tdurieux/anonymous_github.git synced 2026-09-12 13:48:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: decode and validate webview file paths

Browse Source
This commit is contained in:
tdurieux
2026-09-06 09:17:56 +02:00
parent 67eb83674c
commit 9c18526d52
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/production-regressions.test.js
+2 -2
View File
@@ -152,7 +152,7 @@ describe("production regressions", function () {
expect(second.headers.ETag).not.to.equal(first.headers.ETag);
expect(second.statusCode).not.to.equal(304);
});
it("sandboxes rendered webview documents", async function () {
it("decodes webview filenames and sandboxes rendered documents", async function () {
const File = require("../src/core/AnonymizedFile").default;
const utils = require("../src/server/routes/route-utils");
const repo = { options: { terms: [], page: true, pageSource: { path: "/", branch: "main" }, image: true }, model: { source: { branch: "main" } } };
@@ -162,7 +162,7 @@ describe("production regressions", function () {
stub(File.prototype, "send", async () => {});
const handler = require("../src/server/routes/webview").default.stack[0].route.stack[0].handle;
const res = response();
await handler({ path: "/repo/my file.html", params: { repoId: "repo" }, headers: {} }, res);
await handler({ path: "/repo/my%20file.html", params: { repoId: "repo" }, headers: {} }, res);
expect(path).to.equal("my file.html");
expect(res.headers["Content-Security-Policy"]).to.include("sandbox");
expect(res.headers["Content-Security-Policy"]).not.to.include("allow-same-origin");