CERBERUS/speedtest
1
0
Fork 0
mirror of https://github.com/librespeed/speedtest.git synced 2026-10-21 07:40:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

test(e2e): reject malformed static-server paths

Browse source
This commit is contained in:
Stefan Stidl 2026-09-11 20:47:25 +02:00
parent d719d54eeb
commit 056fcadbc6
2 changed files with 20 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/e2e/static-repository-assets.spec.js
View file

@ -32,4 +32,12 @@ test.describe("Unmodified repository static assets", () => {
const missing = await request.get(`${staticRepositoryUrl}/does-not-exist`);
expect(missing.status()).toBe(404);
});
test("returns 400 for malformed percent-encoded paths without stopping the server", async ({ request }) => {
const malformed = await request.get(`${staticRepositoryUrl}/%E0%A4%A`);
expect(malformed.status()).toBe(400);
const followingRequest = await request.get(`${staticRepositoryUrl}/settings.json`);
expect(followingRequest.status()).toBe(200);
});
});

15
tests/e2e/static-server.js
View file

@ -22,9 +22,18 @@ http
return;
}
const url = new URL(request.url, "http://127.0.0.1");
const pathname = url.pathname === "/" ? "/index.html" : url.pathname;
const file = path.resolve(root, `.${decodeURIComponent(pathname)}`);
let pathname;
try {
const url = new URL(request.url, "http://127.0.0.1");
pathname = url.pathname === "/" ? "/index.html" : url.pathname;
pathname = decodeURIComponent(pathname);
} catch {
response.writeHead(400);
response.end();
return;
}
const file = path.resolve(root, `.${pathname}`);
if (!file.startsWith(`${root}${path.sep}`)) {
response.writeHead(403);