SHA256
Yuvomi Mobile Contributors
69c48169e2
Require iOS 18.4 for explicit upload denial in the isolated authentication window. Add origin-bound generated download policy, app-switcher privacy, typed metadata regressions and original community icon assets. Seven portable tests and Swift formatting checks pass; Apple SDK validation remains external.
41 lines
2.0 KiB
Swift
41 lines
2.0 KiB
Swift
import XCTest
|
|
|
|
@testable import Yuvomi
|
|
|
|
final class ServerAddressTests: XCTestCase {
|
|
func testCanonicalizationAndPorts() throws {
|
|
XCTAssertEqual(try ServerAddress(" HTTPS://Family.Example:443/ ").url.absoluteString, "https://family.example")
|
|
XCTAssertEqual(try ServerAddress("https://family.example:8443").url.port, 8443)
|
|
XCTAssertEqual(try ServerAddress("https://[::1]:8443").url.port, 8443)
|
|
}
|
|
func testUnsafeConfigurations() {
|
|
for value in [
|
|
"http://family.example", "javascript:alert(1)", "https://u:p@family.example",
|
|
"https://family.example/subpath", "https://family.example?token=secret",
|
|
"https://family.example/#token", "https://family.example:0",
|
|
"https://family.example:65536", "https://family.example/%2f",
|
|
"https://family.example\\@evil.test", "https:///", "",
|
|
] {
|
|
XCTAssertThrowsError(try ServerAddress(value), value)
|
|
}
|
|
}
|
|
func testOriginIsolation() throws {
|
|
let server = try ServerAddress("https://family.example")
|
|
XCTAssertTrue(server.owns(URL(string: "https://FAMILY.example:443/tasks?id=1")!))
|
|
for value in [
|
|
"https://family.example.evil.test", "https://family.example@evil.test",
|
|
"https://user@family.example", "http://family.example", "https://family.example:8443",
|
|
"file:///etc/passwd", "data:text/html,hi",
|
|
] {
|
|
XCTAssertFalse(server.owns(URL(string: value)!), value)
|
|
}
|
|
}
|
|
func testBlobExportsAreOriginBound() throws {
|
|
let server = try ServerAddress("https://family.example")
|
|
XCTAssertTrue(server.ownsDownload(URL(string: "blob:https://family.example/unique-id")!))
|
|
XCTAssertFalse(server.ownsDownload(URL(string: "blob:https://evil.example/unique-id")!))
|
|
XCTAssertFalse(server.ownsDownload(URL(string: "blob:http://family.example/unique-id")!))
|
|
XCTAssertFalse(server.ownsDownload(URL(string: "file:///tmp/export")!))
|
|
}
|
|
}
|