Skip to content

Commit

Permalink
update tests for login link
Browse files Browse the repository at this point in the history
  • Loading branch information
accbjt committed Jul 19, 2024
1 parent 78a34d6 commit c005f59
Show file tree
Hide file tree
Showing 6 changed files with 58 additions and 57 deletions.
12 changes: 6 additions & 6 deletions blocks/identity-block/components/login/index.jsx
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,11 @@ const useLogin = ({

const setRedirectUrl = (url) => {
setCurrentRedirectToURL(url);
localStorage.setItem('ArcXP_redirectUrl', url);
sessionStorage.setItem('ArcXP_redirectUrl', url);
};

const getRedirectURL = () => {
const localStorageRedirectUrl = localStorage.getItem('ArcXP_redirectUrl');
const localStorageRedirectUrl = sessionStorage.getItem('ArcXP_redirectUrl');

return redirectQueryParam || localStorageRedirectUrl || currentRedirectToURL;
};
Expand Down Expand Up @@ -100,12 +100,12 @@ const useLogin = ({
if (isOIDC) {
loginByOIDC();
} else {
const localStorageRedirectUrl = localStorage.getItem('ArcXP_redirectUrl');
const newRedirectUrl = redirectQueryParam || localStorageRedirectUrl || validatedLoggedInPageLoc;
const localStorageRedirectUrl = sessionStorage.getItem('ArcXP_redirectUrl');
const validatedLocalRedirectURL = validateURL(localStorageRedirectUrl);
const newRedirectUrl = redirectQueryParam || validatedLocalRedirectURL || validatedLoggedInPageLoc;

window.location.assign(newRedirectUrl);
window.location = newRedirectUrl;

Check warning

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
.

Check failure

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
.
}
localStorage.removeItem('ArcXP_redirectUrl');
}
};
if (Identity && !isAdmin) {
Expand Down
94 changes: 47 additions & 47 deletions blocks/identity-block/components/login/index.test.jsx
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ const Test = (props) => {
};

const windowLocationValues = {
assign: jest.fn((url) => { window.location = url }),
origin: 'http://localhost',
href: 'http://localhost',
search: '',
Expand Down Expand Up @@ -124,7 +123,7 @@ describe("useLogin()", () => {
}));
await render(<Test />);

expect(window.location).toBe(defaultParams.redirectURL);
expect(window.location).toBe(`http://localhost${defaultParams.redirectURL}`);
});

it("replaces potentially unsafe URLs in query param", async () => {
Expand All @@ -141,21 +140,23 @@ describe("useLogin()", () => {
expect(window.location).toBe("/");
});

it("replaces potentially unsafe URLs in redirectURL parameter", async () => {
await render(<Test redirectURL="https://somewhere.com" />);
it("replaces potentially unsafe URLs in query param", async () => {
Object.defineProperty(window, "location", {
writable: true,
value: {
...windowLocationValues,
search: "",
pathname: "/",
},
});
await render(<Test loggedInPageLocation="https://somewhere.com" />);
fireEvent.click(screen.getByRole("button"));
expect(window.location).toBe("/");
});

it("replaces potentially unsafe URLs in loggedInPageLocation parameter", async () => {
useIdentity.mockImplementation(() => ({
isInitialized: true,
Identity: {
isLoggedIn: jest.fn(() => true),
getConfig: jest.fn(() => ({})),
},
}));
await render(<Test loggedInPageLocation="https://somewhere.com" />);
it("replaces potentially unsafe URLs in redirectURL parameter", async () => {
await render(<Test redirectURL="https://somewhere.com" />);
fireEvent.click(screen.getByRole("button"));
expect(window.location).toBe("/");
});

Expand All @@ -181,38 +182,37 @@ describe("useLogin()", () => {
delete document.referrer;
});

// it("should use redirectUrl from localStorage", async () => {
// const referrerURL = "http://localhost/featured-articles/";
// Object.defineProperty(document, "referrer", {
// value: referrerURL,
// configurable: true,
// });
// Object.defineProperty(window, "location", {
// writable: true,
// value: {
// ...windowLocationValues,
// origin: 'http://localhost',
// href: 'http://localhost',
// search: '',
// pathname: '/'
// }
// });

// useIdentity.mockImplementation(() => ({
// isInitialized: true,
// Identity: {
// isLoggedIn: jest.fn(() => true),
// getConfig: jest.fn(() => ({})),
// },
// }));

// await render(<Test />);

// expect(localStorage.getItem("ArcXP_redirectUrl")).toBe('http://localhost/featured-articles/');

// fireEvent.click(screen.getByRole("button"));
// expect(window.location).toBe("/featured-articles/");
// expect(localStorage.getItem("ArcXP_redirectUrl")).toBeNull();
// delete document.referrer;
// });
it("should use redirectUrl from sessionStorage", async () => {
const referrerURL = "http://localhost/featured-articles/";
Object.defineProperty(document, "referrer", {
value: referrerURL,
configurable: true,
});
Object.defineProperty(window, "location", {
writable: true,
value: {
...windowLocationValues,
origin: 'http://localhost',
href: 'http://localhost',
search: '',
pathname: '/'
}
});

useIdentity.mockImplementation(() => ({
isInitialized: true,
Identity: {
isLoggedIn: jest.fn(() => true),
getConfig: jest.fn(() => ({})),
},
}));

await render(<Test />);

expect(sessionStorage.getItem("ArcXP_redirectUrl")).toBe('/featured-articles/');

fireEvent.click(screen.getByRole("button"));
expect(window.location).toBe("/featured-articles/");
delete document.referrer;
});
});
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ function useSocialSignIn(redirectURL, isOIDC, socialSignOnIn, onError = () => {}
} else {
const validatedURL = validateURL(redirectURL);

window.location.assign(validatedURL);
window.location = validatedURL;
}
} catch (e) {
onError();
Expand Down Expand Up @@ -53,7 +53,7 @@ function useSocialSignIn(redirectURL, isOIDC, socialSignOnIn, onError = () => {}
} else {
const validatedURL = validateURL(redirectURL);

window.location.assign(validatedURL);
window.location.hred = validatedURL;
}
}),
auto_select: true,
Expand Down
2 changes: 1 addition & 1 deletion blocks/identity-block/features/login/default.jsx
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ const Login = ({ customFields }) => {
} else {
const validatedURL = validateURL(loginRedirect);

window.location.assign(validatedURL);
window.location = validatedURL;
}
})
.catch((e) => {
Expand Down
2 changes: 1 addition & 1 deletion blocks/identity-block/features/signup/default.jsx
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ const SignUp = ({ customFields, arcSite }) => {
captchaToken,
)
.then(() => {
window.location.assign(redirectURL);
window.location = redirectURL;
})
.catch((e) => {
setResetRecaptcha(!resetRecaptcha);
Expand Down
1 change: 1 addition & 0 deletions blocks/identity-block/utils/validate-redirect-url.js
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ const validateURL = (url) => {
return url;
}

sessionStorage.setItem("ArcXP_redirectUrl", "/");
return "/";
};

Expand Down

0 comments on commit c005f59

Please sign in to comment.