1package cef
2
3import (
4 "context"
5 "strings"
6 "testing"
7
8 cefmocks "github.com/bnema/purego-cef/cef/mocks"
9 "github.com/stretchr/testify/mock"
10 "github.com/stretchr/testify/require"
11)
12
13func TestResolvePopupOpenerNavigationTarget_ResolvesRelativeAgainstOpener(t *testing.T) {
14 require.Equal(
15 t,
16 "https://example.com/oauth/callback",
17 resolvePopupOpenerNavigationTarget("callback", "https://example.com/oauth/start"),
18 )
19}
20
21func TestResolvePopupOpenerNavigationTarget_PreservesAbsoluteTarget(t *testing.T) {
22 require.Equal(
23 t,
24 "https://accounts.example.com/finish",
25 resolvePopupOpenerNavigationTarget("https://accounts.example.com/finish", "https://example.com/oauth/start"),
26 )
27}
28
29func TestResolvePopupOpenerNavigationTarget_RejectsNonHTTPAbsoluteTarget(t *testing.T) {
30 require.Empty(t, resolvePopupOpenerNavigationTarget("javascript:alert(1)", "https://example.com/oauth/start"))
31 require.Empty(t, resolvePopupOpenerNavigationTarget("data:text/html,boom", "https://example.com/oauth/start"))
32 require.Empty(t, resolvePopupOpenerNavigationTarget("file:///tmp/boom", "https://example.com/oauth/start"))
33}
34
35func TestOriginFromURL_PreservesNonDefaultPort(t *testing.T) {
36 require.Equal(t, "https://example.com:8443", originFromURL("https://example.com:8443/callback"))
37}
38
39func TestOriginFromURL_NormalizesInternalConceptualURLs(t *testing.T) {
40 require.Equal(t, actualInternalOrigin, originFromURL("dumb://history"))
41}
42
43func TestTargetOriginMatchesPopupOpener_NormalizesDefaultPorts(t *testing.T) {
44 require.True(t, targetOriginMatchesPopupOpener("https://example.com:443", "https://example.com/callback"))
45}
46
47func TestHandlePopupOpenerPostMessage_UsesPopupCommittedURIForSourceMetadata(t *testing.T) {
48 frame := cefmocks.NewMockFrame(t)
49 frame.EXPECT().ExecuteJavaScript(mock.MatchedBy(func(script string) bool {
50 return strings.Contains(script, "https://popup.example") &&
51 strings.Contains(script, "https://popup.example/oauth/callback") &&
52 !strings.Contains(script, "https://evil.example")
53 }), "", int32(0)).Once()
54 browser := cefmocks.NewMockBrowser(t)
55 browser.EXPECT().GetMainFrame().Return(frame).Once()
56
57 opener := &WebView{ctx: context.Background(), browser: browser, uri: "https://app.example/session"}
58 popup := &WebView{
59 ctx: context.Background(),
60 uri: "https://popup.example/oauth/callback",
61 popupOpenerBridgeParent: opener,
62 }
63
64 popup.handlePopupOpenerPostMessage(popupOpenerPostMessagePayload{
65 Data: `{"ok":true}`,
66 DataKind: "json",
67 TargetOrigin: "https://app.example",
68 SourceOrigin: "https://evil.example",
69 SourceHref: "https://evil.example/decoy",
70 })
71}