fix: harden HTTP trust boundaries (#1316)

This commit is contained in:
ZacharyZcR
2026-08-24 07:52:31 +08:00
committed by GitHub
parent c4c9b51294
commit 30d72554fc
23 changed files with 167 additions and 62 deletions
+10
View File
@@ -5,6 +5,7 @@ const win = window as unknown as Record<string, unknown>;
afterEach(() => {
delete win.__TERMIX_BASE_PATH__;
document.querySelector('meta[name="termix-base-path"]')?.remove();
});
describe("getBasePath", () => {
@@ -18,6 +19,15 @@ describe("getBasePath", () => {
expect(getBasePath()).toBe("/termix");
});
it("uses the CSP-safe runtime meta value when present", () => {
const meta = document.createElement("meta");
meta.name = "termix-base-path";
meta.content = "/gateway/termix";
document.head.append(meta);
expect(getBasePath()).toBe("/gateway/termix");
});
it("strips a trailing slash from the runtime override", () => {
win.__TERMIX_BASE_PATH__ = "/termix/";
expect(getBasePath()).toBe("/termix");