1package webkit
2
3import (
4 "context"
5 "net/http"
6 "net/url"
7 "strings"
8 "testing"
9
10 "github.com/bnema/dumber/assets"
11 "github.com/stretchr/testify/assert"
12 "github.com/stretchr/testify/require"
13)
14
15func TestCrashOriginalURI(t *testing.T) {
16 assert.Equal(t, "https://example.com/path?q=1", crashOriginalURI("dumb://history/crash?url=https%3A%2F%2Fexample.com%2Fpath%3Fq%3D1"))
17 assert.Empty(t, crashOriginalURI("dumb://history/crash"))
18 assert.Empty(t, crashOriginalURI("%%%"))
19}
20
21func TestBuildCrashPageHTMLIncludesReloadTarget(t *testing.T) {
22 body := buildCrashPageHTML("https://example.com/foo?a=1&b=2")
23 assert.Contains(t, body, `data-target="https://example.com/foo?a=1&b=2"`)
24 assert.Contains(t, body, "https://example.com/foo?a=1&b=2")
25}
26
27func TestBuildCrashPageHTMLFallbackReloadWithoutTarget(t *testing.T) {
28 body := buildCrashPageHTML("")
29 assert.Contains(t, body, "window.location.reload();")
30}
31
32func TestBuildCrashPageHTMLRejectsUnsafeReloadScheme(t *testing.T) {
33 // buildCrashPageHTML receives already-sanitized input from the caller.
34 // sanitizeCrashPageOriginalURI strips unsafe schemes to "".
35 sanitized := sanitizeCrashPageOriginalURI("javascript:alert(1)")
36 assert.Empty(t, sanitized)
37 body := buildCrashPageHTML(sanitized)
38 assert.Contains(t, body, `data-target=""`)
39}
40
41func TestBuildCrashPageHTMLAllowsDumbSchemeTarget(t *testing.T) {
42 body := buildCrashPageHTML("dumb://history")
43 assert.Contains(t, body, `data-target="dumb://history"`)
44}
45
46func TestBuildCrashPageHTMLEscapesScriptBreakoutPayload(t *testing.T) {
47 payload := `https://example.com/?q=</script><script>alert(1)</script>`
48 body := buildCrashPageHTML(payload)
49 assert.NotContains(t, body, "</script><script>alert(1)</script>")
50 assert.Contains(t, body, "</script><script>alert(1)</script>")
51}
52
53func TestIsTrustedSystemviewURL(t *testing.T) {
54 t.Parallel()
55
56 for _, raw := range []string{
57 "dumb://history",
58 "dumb://favorites",
59 "dumb:config",
60 } {
61 require.True(t, isTrustedSystemviewURL(raw), raw)
62 }
63 for _, raw := range []string{
64 "",
65 "https://dumber.invalid/history",
66 "dumb://api/favicon",
67 "dumb://evil/history",
68 } {
69 require.False(t, isTrustedSystemviewURL(raw), raw)
70 }
71}
72
73func TestIsTrustedSystemviewFaviconRequestRequiresTrustedRefererWhenOriginAbsent(t *testing.T) {
74 t.Parallel()
75
76 require.True(t, isTrustedSystemviewFaviconRequest(&SchemeRequest{Referer: "dumb://history"}))
77 require.False(t, isTrustedSystemviewFaviconRequest(&SchemeRequest{Referer: ""}))
78}
79
80func TestIsTrustedSystemviewFaviconRequestHonorsOriginBeforeReferer(t *testing.T) {
81 t.Parallel()
82
83 require.True(t, isTrustedSystemviewFaviconRequest(&SchemeRequest{Origin: "dumb://history"}))
84 require.True(t, isTrustedSystemviewFaviconRequest(&SchemeRequest{Origin: "dumb://history", Referer: "https://evil.example"}))
85 require.False(t, isTrustedSystemviewFaviconRequest(&SchemeRequest{Origin: "https://evil.example", Referer: "dumb://history"}))
86}
87
88func TestRegisterDefaultsIncludesCrashHandler(t *testing.T) {
89 handler := NewDumbSchemeHandler(context.Background())
90 require.NotNil(t, handler)
91
92 handler.mu.RLock()
93 crashHandler, ok := handler.handlers["/crash"]
94 handler.mu.RUnlock()
95 require.True(t, ok)
96 require.NotNil(t, crashHandler)
97
98 resp := crashHandler.Handle(&SchemeRequest{
99 URI: "dumb://history/crash?url=https%3A%2F%2Fexample.com",
100 Path: "/crash",
101 Method: "GET",
102 Scheme: "dumb",
103 })
104 require.NotNil(t, resp)
105 assert.Equal(t, 200, resp.StatusCode)
106 assert.Equal(t, "text/html; charset=utf-8", resp.ContentType)
107 assert.Contains(t, string(resp.Data), "Renderer process ended")
108}
109
110func TestCrashHandlerSanitizesUnsafeURLQuery(t *testing.T) {
111 handler := NewDumbSchemeHandler(context.Background())
112 require.NotNil(t, handler)
113
114 handler.mu.RLock()
115 crashHandler, ok := handler.handlers["/crash"]
116 handler.mu.RUnlock()
117 require.True(t, ok)
118 require.NotNil(t, crashHandler)
119
120 resp := crashHandler.Handle(&SchemeRequest{
121 URI: "dumb://history/crash?url=javascript%3Aalert(1)",
122 Path: "/crash",
123 Method: "GET",
124 Scheme: "dumb",
125 })
126 require.NotNil(t, resp)
127 assert.Contains(t, string(resp.Data), `data-target=""`)
128}
129
130func TestHandleAsset_ConfigOpaqueFormServesSystemviewsShell(t *testing.T) {
131 h := NewDumbSchemeHandler(context.Background())
132 h.SetAssets(assets.WebUIAssets)
133
134 u, err := url.Parse("dumb:config")
135 require.NoError(t, err)
136
137 resp := h.handleAsset(u)
138 require.NotNil(t, resp)
139 assert.Equal(t, "text/html; charset=utf-8", resp.ContentType)
140 assert.Contains(t, string(resp.Data), "systemviews.wasm")
141}
142
143func TestHandleAsset_SystemviewsCSSIsServed(t *testing.T) {
144 h := NewDumbSchemeHandler(context.Background())
145 h.SetAssets(assets.WebUIAssets)
146
147 u, err := url.Parse("dumb://history/systemviews.css")
148 require.NoError(t, err)
149
150 resp := h.handleAsset(u)
151 require.NotNil(t, resp)
152 // Charset suffixes are acceptable; assert the MIME type contract only.
153 assert.Equal(t, "text/css", strings.Split(resp.ContentType, ";")[0])
154 assert.Contains(t, string(resp.Data), ".sv-app")
155}
156
157func TestHandleAsset_SystemviewsRootsServeShell(t *testing.T) {
158 h := NewDumbSchemeHandler(context.Background())
159 h.SetAssets(assets.WebUIAssets)
160
161 tests := []string{
162 "dumb://history",
163 "dumb:history",
164 "dumb://favorites",
165 "dumb:favorites",
166 "dumb://config",
167 "dumb:config",
168 "dumb://error",
169 "dumb:error",
170 }
171
172 for _, raw := range tests {
173 t.Run(raw, func(t *testing.T) {
174 u, err := url.Parse(raw)
175 require.NoError(t, err)
176
177 resp := h.handleAsset(u)
178 require.NotNil(t, resp)
179 assert.Equal(t, "text/html; charset=utf-8", resp.ContentType)
180 assert.Contains(t, string(resp.Data), "systemviews.wasm")
181 })
182 }
183}
184
185func TestConfigHandlersUseInjectedPayloadBuilders(t *testing.T) {
186 h := NewDumbSchemeHandler(context.Background())
187 h.SetConfigPayloadBuilders(
188 func() ([]byte, error) { return []byte(`{"current":true}`), nil },
189 func() ([]byte, error) { return []byte(`{"default":true}`), nil },
190 )
191
192 h.mu.RLock()
193 currentHandler := h.handlers["/api/config"]
194 defaultHandler := h.handlers["/api/config/default"]
195 h.mu.RUnlock()
196 require.NotNil(t, currentHandler)
197 require.NotNil(t, defaultHandler)
198
199 currentResp := currentHandler.Handle(&SchemeRequest{
200 URI: "dumb://config/api/config",
201 Path: "/api/config",
202 Method: http.MethodGet,
203 Scheme: "dumb",
204 Referer: "dumb://config",
205 })
206 require.NotNil(t, currentResp)
207 assert.Equal(t, http.StatusOK, currentResp.StatusCode)
208 assert.Equal(t, "application/json", currentResp.ContentType)
209 assert.Equal(t, []byte(`{"current":true}`), currentResp.Data)
210
211 defaultResp := defaultHandler.Handle(&SchemeRequest{
212 URI: "dumb://config/api/config/default",
213 Path: "/api/config/default",
214 Method: http.MethodGet,
215 Scheme: "dumb",
216 Referer: "dumb://config",
217 })
218 require.NotNil(t, defaultResp)
219 assert.Equal(t, http.StatusOK, defaultResp.StatusCode)
220 assert.Equal(t, "application/json", defaultResp.ContentType)
221 assert.Equal(t, []byte(`{"default":true}`), defaultResp.Data)
222}
223
224func TestConfigHandlersRejectUntrustedRequests(t *testing.T) {
225 h := NewDumbSchemeHandler(context.Background())
226 h.SetConfigPayloadBuilders(
227 func() ([]byte, error) { return []byte(`{"current":true}`), nil },
228 func() ([]byte, error) { return []byte(`{"default":true}`), nil },
229 )
230
231 h.mu.RLock()
232 currentHandler := h.handlers["/api/config"]
233 defaultHandler := h.handlers["/api/config/default"]
234 h.mu.RUnlock()
235
236 for _, handler := range []PageHandler{currentHandler, defaultHandler} {
237 resp := handler.Handle(&SchemeRequest{Method: http.MethodGet, Origin: "https://evil.example"})
238 require.NotNil(t, resp)
239 assert.Equal(t, http.StatusForbidden, resp.StatusCode)
240 assert.True(t, resp.SuppressDefaultHeaders)
241 assert.NotContains(t, resp.Headers, "Access-Control-Allow-Origin")
242 }
243}
244
245func TestShouldAddCORSHeaders(t *testing.T) {
246 t.Parallel()
247
248 tests := []struct {
249 name string
250 path string
251 want bool
252 }{
253 {name: "private api route", path: "/api/config", want: false},
254 {name: "wasm asset", path: "/systemviews.wasm", want: true},
255 {name: "html shell", path: "/", want: false},
256 {name: "js asset", path: "/wasm_exec.js", want: false},
257 }
258
259 for _, tt := range tests {
260 t.Run(tt.name, func(t *testing.T) {
261 t.Parallel()
262 assert.Equal(t, tt.want, shouldAddCORSHeaders(tt.path))
263 })
264 }
265}
266
267func TestResponseHeadersForPath_WASMIncludesContentTypeAndCORS(t *testing.T) {
268 t.Parallel()
269
270 headers := responseHeadersForPath("/systemviews.wasm", "application/wasm")
271 assert.Equal(t, "application/wasm", headers["Content-Type"])
272 assert.Equal(t, "*", headers["Access-Control-Allow-Origin"])
273 assert.Equal(t, "GET, POST, OPTIONS", headers["Access-Control-Allow-Methods"])
274}
275
276func TestReadAssetWithEncodingDecompressesEmbeddedBrotliWASM(t *testing.T) {
277 t.Parallel()
278
279 data, err := readAssetWithEncoding(assets.WebUIAssets, "systemviews/systemviews.wasm", "systemviews.wasm")
280 require.NoError(t, err)
281 require.GreaterOrEqual(t, len(data), 4)
282 assert.Equal(t, "\x00asm", string(data[:4]))
283}
284
285func TestHandleAssetRejectsTraversalOutsideSystemviews(t *testing.T) {
286 h := NewDumbSchemeHandler(context.Background())
287 h.SetAssets(assets.WebUIAssets)
288
289 for _, raw := range []string{
290 "dumb://history/../logo.svg",
291 "dumb://history/nested/../../logo.svg",
292 } {
293 t.Run(raw, func(t *testing.T) {
294 u, err := url.Parse(raw)
295 require.NoError(t, err)
296 assert.Nil(t, h.handleAsset(u))
297 })
298 }
299}
300
301func TestSafeSystemviewsAssetPathRejectsTraversal(t *testing.T) {
302 t.Parallel()
303
304 fullPath, relPath, ok := safeSystemviewsAssetPath(systemviewsAssetDir, "nested/../systemviews.css")
305 require.True(t, ok)
306 assert.Equal(t, "systemviews/systemviews.css", fullPath)
307 assert.Equal(t, "systemviews.css", relPath)
308
309 invalid := []struct {
310 name string
311 assetDir string
312 relPath string
313 }{
314 {name: "parent escape", assetDir: systemviewsAssetDir, relPath: "../logo.svg"},
315 {name: "nested parent escape", assetDir: systemviewsAssetDir, relPath: "nested/../../logo.svg"},
316 {name: "absolute parent escape", assetDir: systemviewsAssetDir, relPath: "/../logo.svg"},
317 {name: "null byte", assetDir: systemviewsAssetDir, relPath: "systemviews.css\x00"},
318 {name: "wrong asset dir", assetDir: "logos", relPath: "logo.svg"},
319 }
320 for _, tt := range invalid {
321 t.Run(tt.name, func(t *testing.T) {
322 t.Parallel()
323 _, _, ok := safeSystemviewsAssetPath(tt.assetDir, tt.relPath)
324 assert.False(t, ok)
325 })
326 }
327}