nessi/Yuvomi-App
SHA256
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ios): restrict authentication capabilities and validate bootstrap types

Browse Source 
Require iOS 18.4 for explicit upload denial in the isolated authentication window. Add origin-bound generated download policy, app-switcher privacy, typed metadata regressions and original community icon assets. Seven portable tests and Swift formatting checks pass; Apple SDK validation remains external.
This commit is contained in:
Yuvomi Mobile Contributors committed 2026-10-20 23:45:01 +02:00
1 parent 74c2c9e6e8
commit 69c48169e2
15 files changed
+341 -112
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ios/Tests/ServerAddressTests.swift
+20 -8
View File
@@ -1,4 +1,5 @@
import XCTest
@testable import Yuvomi
final class ServerAddressTests: XCTestCase {
@@ -8,21 +9,32 @@ final class ServerAddressTests: XCTestCase {
XCTAssertEqual(try ServerAddress("https://[::1]:8443").url.port, 8443)
}
func testUnsafeConfigurations() {
for value in ["http://family.example", "javascript:alert(1)", "https://u:p@family.example",
"https://family.example/subpath", "https://family.example?token=secret",
"https://family.example/#token", "https://family.example:0",
"https://family.example:65536", "https://family.example/%2f",
"https://family.example\\@evil.test", "https:///", ""] {
for value in [
"http://family.example", "javascript:alert(1)", "https://u:p@family.example",
"https://family.example/subpath", "https://family.example?token=secret",
"https://family.example/#token", "https://family.example:0",
"https://family.example:65536", "https://family.example/%2f",
"https://family.example\\@evil.test", "https:///", "",
] {
XCTAssertThrowsError(try ServerAddress(value), value)
}
}
func testOriginIsolation() throws {
let server = try ServerAddress("https://family.example")
XCTAssertTrue(server.owns(URL(string: "https://FAMILY.example:443/tasks?id=1")!))
for value in ["https://family.example.evil.test", "https://family.example@evil.test",
"https://user@family.example", "http://family.example", "https://family.example:8443",
"file:///etc/passwd", "data:text/html,hi"] {
for value in [
"https://family.example.evil.test", "https://family.example@evil.test",
"https://user@family.example", "http://family.example", "https://family.example:8443",
"file:///etc/passwd", "data:text/html,hi",
] {
XCTAssertFalse(server.owns(URL(string: value)!), value)
}
}
func testBlobExportsAreOriginBound() throws {
let server = try ServerAddress("https://family.example")
XCTAssertTrue(server.ownsDownload(URL(string: "blob:https://family.example/unique-id")!))
XCTAssertFalse(server.ownsDownload(URL(string: "blob:https://evil.example/unique-id")!))
XCTAssertFalse(server.ownsDownload(URL(string: "blob:http://family.example/unique-id")!))
XCTAssertFalse(server.ownsDownload(URL(string: "file:///tmp/export")!))
}
}