Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GH-1477 Wildcard/Regex Whitelisting #501

Merged
merged 8 commits into from Mar 3, 2020
Prev

Fix localhost:3000

  • Loading branch information
benstrumeyer committed Mar 3, 2020
commit 5e3998b785f0e74e2fc5908e369610db7506d56f
@@ -146,7 +146,7 @@ class TrustAndRestrict extends React.Component {

isValidUrlorWildcard(pageHost) {
This conversation was marked as resolved by christophertino

This comment has been minimized.

@christophertino

christophertino Mar 2, 2020
Member

This fails when trying to add localhost:3000 to the list.

This comment has been minimized.

@benstrumeyer

benstrumeyer Mar 3, 2020
Author Contributor

Good catch! I fixed the validation regex and added a unit test

// Only allow valid host name characters, ':' for port numbers and '*' for wildcards
const isSafePageHost = /^[a-zA-Z1-9-.:*]*$/;
const isSafePageHost = /^[a-zA-Z0-9-.:*]*$/;
if (!isSafePageHost.test(pageHost)) { return false; }

// Check for valid URL from node-validator
@@ -31,11 +31,17 @@ describe('app/panel/components/Settings/TrustAndRestrict', () => {
describe('app/panel/components/Settings/', () => {
test('isValidUrlorWildcard should return true with url entered', () => {
const wrapper = shallow(<TrustAndRestrict />);
const input = 'ghostery.com';
let input = 'ghostery.com';

const fn = jest.spyOn(wrapper.instance(), 'isValidUrlorWildcard');
let fn = jest.spyOn(wrapper.instance(), 'isValidUrlorWildcard');
when(fn).calledWith(input);
const returnValue = wrapper.instance().isValidUrlorWildcard(input);
let returnValue = wrapper.instance().isValidUrlorWildcard(input);
expect(returnValue).toBe(true);

input = 'localhost:3000';
fn = jest.spyOn(wrapper.instance(), 'isValidUrlorWildcard');
when(fn).calledWith(input);
returnValue = wrapper.instance().isValidUrlorWildcard(input);
expect(returnValue).toBe(true);
});

ProTip! Use n and p to navigate between commits in a pull request.