import { describe, it, expect } from 'vitest' import { assertHttpUrl } from '../src/main/url' import { isAllowedLoginUrl } from '../src/main/cookies' import { isTrustedDownloadUrl, extractSha256, compareVersions } from '../src/main/updater' import { isYtdlpUpdateChannel } from '@shared/ipc' // --- F5: assertHttpUrl — argument-injection guard + normalisation ----------- describe('assertHttpUrl (audit F5)', () => { it('accepts http(s) URLs and returns the normalised href', () => { expect(assertHttpUrl('https://www.youtube.com/watch?v=abc')).toBe( 'https://www.youtube.com/watch?v=abc' ) // http with a bare host normalises to a trailing slash expect(assertHttpUrl('http://example.com')).toBe('http://example.com/') }) it('trims surrounding whitespace', () => { expect(assertHttpUrl(' https://example.com/v ')).toBe('https://example.com/v') }) it('strips interior tabs/newlines the URL parser tolerates (normalised output)', () => { // Returning the raw input would leak these through to argv / loadURL. expect(assertHttpUrl('https://exa\nmple.com/v')).toBe('https://example.com/v') const out = assertHttpUrl('https://example.com/a\tb') expect(out).not.toContain('\t') expect(out).not.toContain('\n') }) it('rejects non-http(s) protocols', () => { expect(() => assertHttpUrl('file:///C:/Windows/system32')).toThrow() expect(() => assertHttpUrl('javascript:alert(1)')).toThrow() expect(() => assertHttpUrl('ftp://example.com/x')).toThrow() expect(() => assertHttpUrl('aerofetch://download?url=x')).toThrow() }) it('rejects unparseable input', () => { expect(() => assertHttpUrl('not a url')).toThrow() expect(() => assertHttpUrl('')).toThrow() }) it('can never return a value that begins with "-" (would read as a yt-dlp flag)', () => { // A leading '-' cannot start a valid URL scheme, so it always throws — // the returned value therefore never opens with a dash. expect(() => assertHttpUrl('-https://example.com')).toThrow() }) }) // --- T4: isAllowedLoginUrl — sign-in window navigation confinement ---------- describe('isAllowedLoginUrl (audit T4)', () => { it('allows http(s) and about:blank', () => { expect(isAllowedLoginUrl('https://accounts.google.com/signin')).toBe(true) expect(isAllowedLoginUrl('http://example.com/login')).toBe(true) expect(isAllowedLoginUrl('about:blank')).toBe(true) }) it('blocks file://, the app protocol, and other external URI schemes', () => { expect(isAllowedLoginUrl('file:///C:/Windows/System32/calc.exe')).toBe(false) expect(isAllowedLoginUrl('aerofetch://download?url=https://evil.test')).toBe(false) expect(isAllowedLoginUrl('ms-settings:')).toBe(false) expect(isAllowedLoginUrl('mailto:x@y.z')).toBe(false) expect(isAllowedLoginUrl('javascript:alert(1)')).toBe(false) }) it('blocks unparseable input', () => { expect(isAllowedLoginUrl('not a url')).toBe(false) expect(isAllowedLoginUrl('')).toBe(false) }) }) // --- app-updater: isTrustedDownloadUrl — host allowlist across redirect hops - describe('isTrustedDownloadUrl (app-updater host allowlist)', () => { const onHost = 'https://github.com/debont80/AeroFetch/releases/download/v1/AeroFetch-Setup.exe' const onCdnHost = 'https://release-assets.githubusercontent.com/github-production-release-asset/123/abc' it('accepts https URLs on github.com and its asset CDN hosts', () => { expect(isTrustedDownloadUrl(onHost)).toBe(true) expect(isTrustedDownloadUrl(onCdnHost)).toBe(true) expect( isTrustedDownloadUrl( 'https://objects.githubusercontent.com/github-production-release-asset/x' ) ).toBe(true) }) it('rejects a different host — the redirect/MITM bounce vector', () => { expect(isTrustedDownloadUrl('https://evil.example/AeroFetch-Setup.exe')).toBe(false) }) it('rejects a lookalike subdomain', () => { expect(isTrustedDownloadUrl('https://github.com.evil.example/x.exe')).toBe(false) }) it('rejects a trusted hostname on an unexpected port', () => { expect(isTrustedDownloadUrl('https://github.com:1234/x.exe')).toBe(false) }) it('rejects plain http even on a trusted host', () => { expect(isTrustedDownloadUrl('http://github.com/x.exe')).toBe(false) }) it('is not fooled by a trusted host placed in the userinfo', () => { expect(isTrustedDownloadUrl('https://github.com@evil.example/x.exe')).toBe(false) }) it('rejects unparseable input', () => { expect(isTrustedDownloadUrl('not a url')).toBe(false) expect(isTrustedDownloadUrl('')).toBe(false) }) }) // --- app-updater: extractSha256 — checksum-file parsing ---------------------- describe('extractSha256 (app-updater checksum parsing)', () => { const hash = 'a'.repeat(64) it('reads a bare lowercase digest', () => { expect(extractSha256(hash)).toBe(hash) }) it('reads sha256sum format (` filename`)', () => { expect(extractSha256(`${hash} AeroFetch-Setup-0.5.0.exe\n`)).toBe(hash) }) it('lowercases a PowerShell Get-FileHash (uppercase) digest', () => { expect(extractSha256('A'.repeat(64))).toBe(hash) }) it('returns null when there is no standalone 64-char hex token', () => { expect(extractSha256('')).toBeNull() expect(extractSha256('not a checksum')).toBeNull() expect(extractSha256('deadbeef')).toBeNull() // too short }) it('does not slice a 64-char window out of a longer hex run (e.g. sha512)', () => { expect(extractSha256('a'.repeat(128))).toBeNull() }) it('matches the hash on the line naming the asset in a combined file (B3)', () => { const other = 'b'.repeat(64) const combined = `${other} OtherApp.exe\n${hash} *AeroFetch-Setup-0.5.0.exe\n` // Without the filename it would pick the FIRST hash (the wrong one); with the // asset name it must select the line that actually names the installer. expect(extractSha256(combined)).toBe(other) expect(extractSha256(combined, 'AeroFetch-Setup-0.5.0.exe')).toBe(hash) }) it('falls back to the only digest when a bare file omits the filename', () => { expect(extractSha256(hash, 'AeroFetch-Setup-0.5.0.exe')).toBe(hash) }) }) // --- app-updater: compareVersions — prerelease never outranks its release ---- describe('compareVersions (app-updater version ordering)', () => { it('orders by numeric components', () => { expect(compareVersions('0.5.0', '0.4.0')).toBe(1) expect(compareVersions('0.4.0', '0.5.0')).toBe(-1) expect(compareVersions('1.2.3', '1.2.3')).toBe(0) }) it('treats a leading v as cosmetic', () => { expect(compareVersions('v0.5.0', '0.5.0')).toBe(0) }) it('never sorts a prerelease above its final release', () => { // 0.5.0-rc.1 must not be offered as an "upgrade" over a running 0.5.0 expect(compareVersions('0.5.0-rc.1', '0.5.0')).toBe(0) }) it('treats missing trailing components as zero (L36)', () => { // Differing component counts: the shorter version pads with 0s, so 1.2 == 1.2.0 // and 1.2 < 1.2.1, rather than mis-ordering on length. expect(compareVersions('1.2', '1.2.0')).toBe(0) expect(compareVersions('1.2', '1.2.1')).toBe(-1) expect(compareVersions('1.2.1', '1.2')).toBe(1) expect(compareVersions('1', '1.0.0')).toBe(0) }) }) // --- F1: isYtdlpUpdateChannel — --update-to allowlist ----------------------- describe('isYtdlpUpdateChannel (audit F1)', () => { it('accepts the two supported channels', () => { expect(isYtdlpUpdateChannel('stable')).toBe(true) expect(isYtdlpUpdateChannel('nightly')).toBe(true) }) it('rejects an arbitrary repository spec (the --update-to RCE vector)', () => { expect(isYtdlpUpdateChannel('evil/yt-dlp@latest')).toBe(false) expect(isYtdlpUpdateChannel('owner/repo')).toBe(false) }) it('rejects other yt-dlp channels not on AeroFetch’s allowlist', () => { expect(isYtdlpUpdateChannel('master')).toBe(false) }) it('rejects non-string / empty values', () => { expect(isYtdlpUpdateChannel('')).toBe(false) expect(isYtdlpUpdateChannel(undefined)).toBe(false) expect(isYtdlpUpdateChannel(null)).toBe(false) expect(isYtdlpUpdateChannel(42)).toBe(false) }) })