From bd7d1e2f169d6cdfecd952a1d3ed55d0f49f4104 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Fri, 28 Sep 2018 23:19:08 -0400 Subject: routes: fix open redirect vulnerability (#5355) Reported by @cezar97. --- pkg/tool/path_test.go | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 pkg/tool/path_test.go (limited to 'pkg/tool/path_test.go') diff --git a/pkg/tool/path_test.go b/pkg/tool/path_test.go new file mode 100644 index 00000000..530238ce --- /dev/null +++ b/pkg/tool/path_test.go @@ -0,0 +1,32 @@ +// Copyright 2018 The Gogs Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package tool + +import ( + "testing" + + . "github.com/smartystreets/goconvey/convey" +) + +func Test_IsSameSiteURLPath(t *testing.T) { + Convey("Check if a path belongs to the same site", t, func() { + testCases := []struct { + url string + expect bool + }{ + {"//github.com", false}, + {"http://github.com", false}, + {"https://github.com", false}, + {"/\\github.com", false}, + + {"/admin", true}, + {"/user/repo", true}, + } + + for _, tc := range testCases { + So(IsSameSiteURLPath(tc.url), ShouldEqual, tc.expect) + } + }) +} -- cgit v1.2.3