41 lines
1.4 KiB
Dart
41 lines
1.4 KiB
Dart
|
// 功能描述：验证登录目标页构造、站内地址校验及开放重定向防护。
|
|||
|
|
// 版本：1.0.0
|
|||
|
|
import 'package:flutter_test/flutter_test.dart';
|
|||
|
|
import 'package:user_app/app/auth_navigation.dart';
|
|||
|
|
|
|||
|
|
/// 覆盖合法深链接、鉴权页循环和外部地址攻击场景。
|
|||
|
|
void main() {
|
|||
|
|
test('保留站内目标页的路径、查询参数和片段', () {
|
|||
|
|
const target = '/orders?status=pending#payment';
|
|||
|
|
|
|||
|
|
expect(sanitizeRedirectTarget(target), target);
|
|||
|
|
final loginUri = Uri.parse(
|
|||
|
|
buildAuthLocation(
|
|||
|
|
'/login',
|
|||
|
|
redirectTarget: target,
|
|||
|
|
sessionExpired: true,
|
|||
|
|
),
|
|||
|
|
);
|
|||
|
|
expect(loginUri.path, '/login');
|
|||
|
|
expect(loginUri.queryParameters['redirect'], target);
|
|||
|
|
expect(loginUri.queryParameters['reason'], 'expired');
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('拒绝外部地址、协议相对地址和鉴权页循环', () {
|
|||
|
|
expect(sanitizeRedirectTarget('https://example.com/orders'), isNull);
|
|||
|
|
expect(sanitizeRedirectTarget('//example.com/orders'), isNull);
|
|||
|
|
expect(sanitizeRedirectTarget(r'/\example.com/orders'), isNull);
|
|||
|
|
expect(sanitizeRedirectTarget('/login'), isNull);
|
|||
|
|
expect(sanitizeRedirectTarget('/register?redirect=/orders'), isNull);
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('非法目标页不写入登录地址', () {
|
|||
|
|
final loginUri = Uri.parse(
|
|||
|
|
buildAuthLocation('/login', redirectTarget: 'https://example.com'),
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
expect(loginUri.path, '/login');
|
|||
|
|
expect(loginUri.queryParameters, isEmpty);
|
|||
|
|
});
|
|||
|
|
}
|