mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-08-29 18:31:33 +00:00
fix: harden HTTP trust boundaries (#1316)
This commit is contained in:
@@ -5,6 +5,7 @@ const win = window as unknown as Record<string, unknown>;
|
||||
|
||||
afterEach(() => {
|
||||
delete win.__TERMIX_BASE_PATH__;
|
||||
document.querySelector('meta[name="termix-base-path"]')?.remove();
|
||||
});
|
||||
|
||||
describe("getBasePath", () => {
|
||||
@@ -18,6 +19,15 @@ describe("getBasePath", () => {
|
||||
expect(getBasePath()).toBe("/termix");
|
||||
});
|
||||
|
||||
it("uses the CSP-safe runtime meta value when present", () => {
|
||||
const meta = document.createElement("meta");
|
||||
meta.name = "termix-base-path";
|
||||
meta.content = "/gateway/termix";
|
||||
document.head.append(meta);
|
||||
|
||||
expect(getBasePath()).toBe("/gateway/termix");
|
||||
});
|
||||
|
||||
it("strips a trailing slash from the runtime override", () => {
|
||||
win.__TERMIX_BASE_PATH__ = "/termix/";
|
||||
expect(getBasePath()).toBe("/termix");
|
||||
|
||||
Reference in New Issue
Block a user