security-normalization.test.js 931 B

123456789101112131415161718192021222324252627282930313233343536373839
  1. 'use strict'
  2. const test = require('tape')
  3. const fastURI = require('..')
  4. test('parse preserves reserved path escapes as data', (t) => {
  5. const components = fastURI.parse('http://example.com/a%2Fb/public/%2e%2e/admin')
  6. t.equal(components.path, '/a%2Fb/public/%2E%2E/admin')
  7. t.end()
  8. })
  9. test('normalize preserves percent-encoded path separators and dot segments', (t) => {
  10. t.equal(
  11. fastURI.normalize('http://example.com/public/%2e%2e/admin'),
  12. 'http://example.com/public/%2E%2E/admin'
  13. )
  14. t.equal(
  15. fastURI.normalize('http://example.com/a%2Fb'),
  16. 'http://example.com/a%2Fb'
  17. )
  18. t.end()
  19. })
  20. test('equal does not treat reserved path escapes as live path syntax', (t) => {
  21. t.equal(
  22. fastURI.equal('http://example.com/public/%2e%2e/admin', 'http://example.com/admin', {}),
  23. false
  24. )
  25. t.equal(
  26. fastURI.equal('http://example.com/a%2Fb', 'http://example.com/a/b', {}),
  27. false
  28. )
  29. t.end()
  30. })