relUrls() picked MusicBrainz link relations by substring (u.includes("bandcamp.com")) with
no scheme check, so a non-http(s) resource or a look-alike host (https://evilbandcamp.com,
javascript:...bandcamp.com...) could be returned and become an injected link's href. Now:
isHttpUrl() accepts http/https only, and matching is by PARSED hostname (=== host ||
endsWith "."+host). Resolver-only; extension unaffected; pure + unit-tested (18 total green).
Source: plan/steward-linker-security SCOUT 2026-06-17.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
123 lines
5.7 KiB
JavaScript
123 lines
5.7 KiB
JavaScript
// Unit tests for the resolver's pure logic (run with `node --test`). Zero-dep.
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { norm, bandcampSearch, spotifySearch, pickArtist, spotifyResult, relUrls, mbResult, primaryOf, isSearchUrl, isHttpUrl } from "./lib.js";
|
|
|
|
test("norm lowercases, trims, NFKC-normalizes", () => {
|
|
assert.equal(norm(" Cerebral Bore "), "cerebral bore");
|
|
assert.equal(norm("DEVOURMENT"), "devourment");
|
|
});
|
|
|
|
test("pickArtist matches case-insensitively, rejects non-matches", () => {
|
|
const items = [{ name: "Cattle Decapitation" }, { name: "Cerebral Bore" }];
|
|
assert.equal(pickArtist("cerebral bore", items)?.name, "Cerebral Bore");
|
|
assert.equal(pickArtist("CATTLE DECAPITATION", items)?.name, "Cattle Decapitation");
|
|
assert.equal(pickArtist("Notarealband", items), null);
|
|
});
|
|
|
|
test("pickArtist enforces minScore when given (MusicBrainz path)", () => {
|
|
const items = [{ name: "Devourment", score: 100 }, { name: "Devourment", score: 50 }];
|
|
assert.equal(pickArtist("Devourment", items, { minScore: 90 })?.score, 100);
|
|
assert.equal(pickArtist("Devourment", [{ name: "Devourment", score: 50 }], { minScore: 90 }), null);
|
|
});
|
|
|
|
test("pickArtist tolerates empty / garbage input", () => {
|
|
assert.equal(pickArtist("x", null), null);
|
|
assert.equal(pickArtist("x", []), null);
|
|
assert.equal(pickArtist("x", [null, { name: "y" }]), null);
|
|
});
|
|
|
|
test("spotifyResult prefers the direct url, falls back to search", () => {
|
|
const direct = spotifyResult({
|
|
name: "Devourment",
|
|
external_urls: { spotify: "https://open.spotify.com/artist/abc" },
|
|
});
|
|
assert.equal(direct.spotify, "https://open.spotify.com/artist/abc");
|
|
assert.match(direct.bandcamp, /^https:\/\/bandcamp\.com\/search\?q=Devourment/);
|
|
|
|
assert.deepEqual(direct.primary, { platform: "spotify", url: "https://open.spotify.com/artist/abc" });
|
|
|
|
const noUrl = spotifyResult({ name: "Devourment" });
|
|
assert.equal(noUrl.spotify, "https://open.spotify.com/search/Devourment");
|
|
assert.equal(noUrl.primary.platform, "spotify"); // search fallback still points at spotify
|
|
});
|
|
|
|
test("primaryOf / isSearchUrl: prefer direct spotify, else direct bandcamp, else spotify search", () => {
|
|
assert.equal(isSearchUrl("https://open.spotify.com/search/X"), true);
|
|
assert.equal(isSearchUrl("https://open.spotify.com/artist/abc"), false);
|
|
assert.deepEqual(
|
|
primaryOf({ spotify: "https://open.spotify.com/artist/abc", bandcamp: "https://bandcamp.com/search?q=X&item_type=b" }),
|
|
{ platform: "spotify", url: "https://open.spotify.com/artist/abc" },
|
|
);
|
|
assert.deepEqual(
|
|
primaryOf({ spotify: "https://open.spotify.com/search/X", bandcamp: "https://x.bandcamp.com/" }),
|
|
{ platform: "bandcamp", url: "https://x.bandcamp.com/" },
|
|
);
|
|
assert.deepEqual(
|
|
primaryOf({ spotify: "https://open.spotify.com/search/X", bandcamp: "https://bandcamp.com/search?q=X&item_type=b" }),
|
|
{ platform: "spotify", url: "https://open.spotify.com/search/X" },
|
|
);
|
|
});
|
|
|
|
test("relUrls picks direct bandcamp + spotify from MB relations, tolerates junk", () => {
|
|
const relations = [
|
|
{ url: { resource: "https://cattledecapitation.bandcamp.com/" } },
|
|
{ url: { resource: "https://open.spotify.com/artist/67ZMMtA88DDO0gTuRrzGjn" } },
|
|
{ url: { resource: "https://en.wikipedia.org/wiki/Cattle_Decapitation" } },
|
|
null,
|
|
{ url: null },
|
|
];
|
|
const links = relUrls(relations);
|
|
assert.equal(links.bandcamp, "https://cattledecapitation.bandcamp.com/");
|
|
assert.equal(links.spotify, "https://open.spotify.com/artist/67ZMMtA88DDO0gTuRrzGjn");
|
|
});
|
|
|
|
test("relUrls returns nulls when relations absent/empty", () => {
|
|
assert.deepEqual(relUrls(null), { bandcamp: null, spotify: null });
|
|
assert.deepEqual(relUrls([]), { bandcamp: null, spotify: null });
|
|
});
|
|
|
|
test("relUrls rejects non-http(s) and look-alike hosts (hardening)", () => {
|
|
const relations = [
|
|
{ url: { resource: "javascript:alert('bandcamp.com')" } }, // not http(s)
|
|
{ url: { resource: "ftp://files.bandcamp.com/x" } }, // not http(s)
|
|
{ url: { resource: "https://evilbandcamp.com/" } }, // host doesn't end in .bandcamp.com
|
|
{ url: { resource: "https://x.bandcamp.com/" } }, // valid subdomain
|
|
];
|
|
const links = relUrls(relations);
|
|
assert.equal(links.bandcamp, "https://x.bandcamp.com/");
|
|
assert.equal(links.spotify, null);
|
|
});
|
|
|
|
test("isHttpUrl accepts http/https only", () => {
|
|
assert.equal(isHttpUrl("https://x.com"), true);
|
|
assert.equal(isHttpUrl("http://x.com"), true);
|
|
assert.equal(isHttpUrl("javascript:alert(1)"), false);
|
|
assert.equal(isHttpUrl("ftp://x/y"), false);
|
|
assert.equal(isHttpUrl("not a url"), false);
|
|
assert.equal(isHttpUrl(null), false);
|
|
});
|
|
|
|
test("mbResult prefers direct links, falls back to search per-platform", () => {
|
|
const direct = mbResult(
|
|
{ name: "Cattle Decapitation" },
|
|
{ bandcamp: "https://cattledecapitation.bandcamp.com/", spotify: "https://open.spotify.com/artist/x" },
|
|
);
|
|
assert.equal(direct.bandcamp, "https://cattledecapitation.bandcamp.com/");
|
|
assert.equal(direct.spotify, "https://open.spotify.com/artist/x");
|
|
assert.deepEqual(direct.primary, { platform: "spotify", url: "https://open.spotify.com/artist/x" });
|
|
|
|
const fallback = mbResult({ name: "Cerebral Bore" }, null);
|
|
assert.equal(fallback.spotify, "https://open.spotify.com/search/Cerebral%20Bore");
|
|
assert.equal(fallback.bandcamp, "https://bandcamp.com/search?q=Cerebral%20Bore&item_type=b");
|
|
|
|
const partial = mbResult({ name: "X" }, { bandcamp: null, spotify: "https://open.spotify.com/artist/y" });
|
|
assert.equal(partial.spotify, "https://open.spotify.com/artist/y");
|
|
assert.match(partial.bandcamp, /bandcamp\.com\/search/);
|
|
});
|
|
|
|
test("link builders url-encode", () => {
|
|
assert.equal(spotifySearch("A B"), "https://open.spotify.com/search/A%20B");
|
|
assert.ok(bandcampSearch("A&B").includes("A%26B"));
|
|
});
|