mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
a907ae714c
Replace `result.url.includes("poe.com")` / `.includes("doubao.com")` with a
parsed `new URL(result.url).hostname` check that accepts the exact host or a
legitimate subdomain (`.endsWith(".poe.com")`). The substring form also matches
hostile URLs like `https://evil.com/?x=poe.com`, which CodeQL flags as
js/incomplete-url-substring-sanitization (2 high-severity alerts on PR #2930).
This strengthens the assertion rather than masking it — the executors build
`https://www.poe.com` / `https://www.doubao.com`, both still satisfied.
33 lines
1.1 KiB
TypeScript
33 lines
1.1 KiB
TypeScript
import { describe, it } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const mod = await import("../../open-sse/executors/doubao-web.ts");
|
|
|
|
describe("DoubaoWebExecutor", () => {
|
|
it("can be instantiated", () => {
|
|
const executor = new mod.DoubaoWebExecutor();
|
|
assert.ok(executor);
|
|
});
|
|
|
|
it("execute returns error on fetch failure", async () => {
|
|
const executor = new mod.DoubaoWebExecutor();
|
|
try {
|
|
const result = await executor.execute({
|
|
model: "doubao-default",
|
|
body: { messages: [{ role: "user", content: "hi" }] },
|
|
stream: false,
|
|
credentials: { apiKey: "" },
|
|
signal: null,
|
|
});
|
|
assert.ok(result.response instanceof Response);
|
|
// Parse the host instead of substring-matching the URL: a bare
|
|
// `.includes("doubao.com")` would also accept hostile URLs like
|
|
// `https://evil.com/?x=doubao.com` (CodeQL js/incomplete-url-substring-sanitization).
|
|
const host = new URL(result.url).hostname;
|
|
assert.ok(host === "doubao.com" || host.endsWith(".doubao.com"), `unexpected host: ${host}`);
|
|
} catch {
|
|
// Network error expected
|
|
}
|
|
});
|
|
});
|