40 lines
1.4 KiB
Dart
40 lines
1.4 KiB
Dart
// 功能描述：验证工作人员端登录目标页构造、站内地址校验及开放重定向防护。
|
||
// 版本：1.0.0
|
||
import 'package:flutter_test/flutter_test.dart';
|
||
import 'package:service_app/app/auth_navigation.dart';
|
||
|
||
/// 覆盖合法深链接、登录循环和外部地址攻击场景。
|
||
void main() {
|
||
test('保留站内目标页的路径、查询参数和片段', () {
|
||
const target = '/tasks/task-1?stage=delivery#evidence';
|
||
|
||
expect(sanitizeRedirectTarget(target), target);
|
||
final loginUri = Uri.parse(
|
||
buildAuthLocation(
|
||
redirectTarget: target,
|
||
sessionExpired: true,
|
||
),
|
||
);
|
||
expect(loginUri.path, '/login');
|
||
expect(loginUri.queryParameters['redirect'], target);
|
||
expect(loginUri.queryParameters['reason'], 'expired');
|
||
});
|
||
|
||
test('拒绝外部地址、协议相对地址和登录页循环', () {
|
||
expect(sanitizeRedirectTarget('https://example.com/tasks'), isNull);
|
||
expect(sanitizeRedirectTarget('//example.com/tasks'), isNull);
|
||
expect(sanitizeRedirectTarget(r'/\example.com/tasks'), isNull);
|
||
expect(sanitizeRedirectTarget('/login'), isNull);
|
||
expect(sanitizeRedirectTarget('/login?redirect=/preflight'), isNull);
|
||
});
|
||
|
||
test('非法目标页不写入登录地址', () {
|
||
final loginUri = Uri.parse(
|
||
buildAuthLocation(redirectTarget: 'https://example.com'),
|
||
);
|
||
|
||
expect(loginUri.path, '/login');
|
||
expect(loginUri.queryParameters, isEmpty);
|
||
});
|
||
}
|