|
| 1 | +import { strict as assert } from "node:assert"; |
| 2 | +import { describe, it } from "node:test"; |
| 3 | + |
| 4 | +import { compileAllowlist } from "./allowlist.mjs"; |
| 5 | + |
| 6 | +describe("compileAllowlist — exact matches", () => { |
| 7 | + it("matches an exact hostname, case-insensitively", () => { |
| 8 | + const m = compileAllowlist(["api.openai.com"]); |
| 9 | + assert.equal(m("api.openai.com"), true); |
| 10 | + assert.equal(m("API.OpenAI.Com"), true); |
| 11 | + assert.equal(m("other.openai.com"), false); |
| 12 | + }); |
| 13 | + |
| 14 | + it("strips a trailing dot on the input (FQDN form)", () => { |
| 15 | + const m = compileAllowlist(["api.openai.com"]); |
| 16 | + assert.equal(m("api.openai.com."), true); |
| 17 | + }); |
| 18 | + |
| 19 | + it("strips a trailing dot on the pattern too", () => { |
| 20 | + const m = compileAllowlist(["api.openai.com."]); |
| 21 | + assert.equal(m("api.openai.com"), true); |
| 22 | + }); |
| 23 | + |
| 24 | + it("returns false for the empty string", () => { |
| 25 | + const m = compileAllowlist(["api.openai.com"]); |
| 26 | + assert.equal(m(""), false); |
| 27 | + }); |
| 28 | + |
| 29 | + it("rejects hostnames not in the list", () => { |
| 30 | + const m = compileAllowlist(["api.openai.com"]); |
| 31 | + assert.equal(m("evil.example.org"), false); |
| 32 | + assert.equal(m("api.openai.com.evil.example.org"), false); |
| 33 | + }); |
| 34 | +}); |
| 35 | + |
| 36 | +describe("compileAllowlist — wildcard prefixes", () => { |
| 37 | + it("matches any subdomain at any depth, but NOT the apex", () => { |
| 38 | + const m = compileAllowlist(["*.googleapis.com"]); |
| 39 | + assert.equal(m("maps.googleapis.com"), true); |
| 40 | + assert.equal(m("a.b.c.googleapis.com"), true); |
| 41 | + // The apex is explicitly excluded — operators must list it separately. |
| 42 | + assert.equal(m("googleapis.com"), false); |
| 43 | + }); |
| 44 | + |
| 45 | + it("doesn't match an unrelated suffix that happens to share letters", () => { |
| 46 | + const m = compileAllowlist(["*.example.com"]); |
| 47 | + // Attacker domain containing "example.com" as a label: the suffix |
| 48 | + // check must NOT match because the match suffix is ".example.com" |
| 49 | + // which isn't literally present at the right boundary. |
| 50 | + assert.equal(m("myexample.com"), false); |
| 51 | + assert.equal(m("example.com.evil.net"), false); |
| 52 | + }); |
| 53 | + |
| 54 | + it("handles multiple wildcards in the config", () => { |
| 55 | + const m = compileAllowlist(["*.googleapis.com", "*.amazonaws.com"]); |
| 56 | + assert.equal(m("s3.us-east-1.amazonaws.com"), true); |
| 57 | + assert.equal(m("maps.googleapis.com"), true); |
| 58 | + assert.equal(m("api.openai.com"), false); |
| 59 | + }); |
| 60 | + |
| 61 | + it("combines exact and wildcard patterns", () => { |
| 62 | + const m = compileAllowlist(["openai.com", "*.openai.com"]); |
| 63 | + assert.equal(m("openai.com"), true); // exact |
| 64 | + assert.equal(m("api.openai.com"), true); // wildcard |
| 65 | + assert.equal(m("other.org"), false); |
| 66 | + }); |
| 67 | +}); |
| 68 | + |
| 69 | +describe("compileAllowlist — edge cases", () => { |
| 70 | + it("returns false on an empty config", () => { |
| 71 | + const m = compileAllowlist([]); |
| 72 | + assert.equal(m("api.openai.com"), false); |
| 73 | + assert.equal(m("anything"), false); |
| 74 | + }); |
| 75 | + |
| 76 | + it("skips empty string entries in the config", () => { |
| 77 | + const m = compileAllowlist(["", "api.openai.com", ""]); |
| 78 | + assert.equal(m("api.openai.com"), true); |
| 79 | + }); |
| 80 | + |
| 81 | + it("treats whitespace-surrounded entries as trimmed", () => { |
| 82 | + const m = compileAllowlist([" api.openai.com "]); |
| 83 | + assert.equal(m("api.openai.com"), true); |
| 84 | + }); |
| 85 | +}); |
0 commit comments