rastrillo / native Public

Download this file

1	import XCTest
2	@testable import RastrilloApple
3	final class OriginTests: XCTestCase {
4	func testOriginRejectsCredentialAndCrossOriginShapes() throws {
5	for value in ["http://example.com", "https://user:password@example.com", "https://example.com/path", "https://example.com?secret=1", "https://example.com#token", "file:///etc/passwd"] {
6	XCTAssertThrowsError(try NativeHTTP.origin(value))
7	}
8	XCTAssertEqual(try NativeHTTP.origin(" https://example.com/ ").absoluteString, "https://example.com")
9	XCTAssertEqual(try NativeHTTP.origin("http://127.0.0.1:8080").host, "127.0.0.1")
10	}
11	func testRequestCannotOverrideOrigin() async throws {
12	let client = NativeHTTP(origin: try NativeHTTP.origin("https://example.com"))
13	for path in ["//evil.test/x", "https://evil.test", "relative"] {
14	do { _ = try await client.response(path); XCTFail("accepted unsafe path") }
15	catch { XCTAssertEqual(error.localizedDescription, "Invalid server path.") }
16	}
17	}
18	}
19