mirror of
https://github.com/different-ai/openwork
synced 2026-04-26 01:25:10 +02:00
a3d6b17a19
Keep server-side share publish and fetch traffic on the configured OpenWork publisher so bundle links cannot steer host requests to arbitrary targets. Add a warning-backed client-side fallback for manual imports from untrusted bundle URLs. Co-authored-by: src-opn <src-opn@users.noreply.github.com>
46 lines
1.2 KiB
TypeScript
46 lines
1.2 KiB
TypeScript
import { strict as assert } from "node:assert";
|
|
|
|
import { describeBundleUrlTrust, isConfiguredBundlePublisherUrl } from "../src/app/bundles/url-policy";
|
|
|
|
const trusted = describeBundleUrlTrust(
|
|
"https://share.openworklabs.com/b/01ARZ3NDEKTSV4RRFFQ69G5FAV",
|
|
"https://share.openworklabs.com",
|
|
);
|
|
|
|
assert.deepEqual(trusted, {
|
|
trusted: true,
|
|
bundleId: "01ARZ3NDEKTSV4RRFFQ69G5FAV",
|
|
actualOrigin: "https://share.openworklabs.com",
|
|
configuredOrigin: "https://share.openworklabs.com",
|
|
});
|
|
|
|
const untrusted = describeBundleUrlTrust(
|
|
"https://evil.example/b/01ARZ3NDEKTSV4RRFFQ69G5FAV",
|
|
"https://share.openworklabs.com",
|
|
);
|
|
|
|
assert.deepEqual(untrusted, {
|
|
trusted: false,
|
|
bundleId: "01ARZ3NDEKTSV4RRFFQ69G5FAV",
|
|
actualOrigin: "https://evil.example",
|
|
configuredOrigin: "https://share.openworklabs.com",
|
|
});
|
|
|
|
assert.equal(
|
|
isConfiguredBundlePublisherUrl(
|
|
"https://share.openworklabs.com/b/01ARZ3NDEKTSV4RRFFQ69G5FAV",
|
|
"https://share.openworklabs.com",
|
|
),
|
|
true,
|
|
);
|
|
|
|
assert.equal(
|
|
isConfiguredBundlePublisherUrl(
|
|
"https://share.openworklabs.com/not-a-bundle",
|
|
"https://share.openworklabs.com",
|
|
),
|
|
false,
|
|
);
|
|
|
|
console.log("bundle-url-policy ok");
|