pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(security): fix CodeQL #689 — Kimi Web URL host substring sanitization (#6048)

Browse Source 
Port the release/v3.8.44 fix to main so the code-scanning alert closes on
the default branch. Parse the URL and assert on the exact hostname instead
of a substring match — `includes("www.kimi.com")` would also accept a
hostile host like `www.kimi.com.evil.net` or `evil.net/?x=www.kimi.com`
(js/incomplete-url-substring-sanitization).
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-03 02:02:50 -03:00
committed by GitHub
parent b729a8f273
commit 5bc11f4d0e
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tests/unit/web-cookie-providers-new.test.ts
View File

@@ -679,8 +679,13 @@ test("Kimi Web: targets www.kimi.com (international)", async () => {
credentials: { apiKey: "kimi-auth=eyJ.eyJzdWI.signature" },
});
assert.ok(result.response instanceof Response);
assert.ok(result.url.includes("www.kimi.com"), `got ${result.url}`);
assert.ok(!result.url.includes("moonshot.cn"));
// Parse the URL and assert on the exact hostname rather than a substring
// match — `includes("www.kimi.com")` would also accept a hostile host like
// `www.kimi.com.evil.net` or `evil.net/?x=www.kimi.com` (CodeQL
// js/incomplete-url-substring-sanitization).
const host = new URL(result.url).hostname;
assert.equal(host, "www.kimi.com", `got ${result.url}`);
assert.notEqual(host, "www.moonshot.cn", `got ${result.url}`);
} finally {
restore.restore();
}