utils/url_test.cc

#include "utils/url.h"

#include <string>

#include "gunit.h"
#include "absl/status/status.h"
#include "absl/strings/string_view.h"

namespace milotic {
namespace {

TEST(UrlTest, UrlDecodeEmptyString) { EXPECT_EQ(UrlDecode(""), ""); }

TEST(UrlTest, UrlDecodeNoHex) { EXPECT_EQ(UrlDecode("hello"), "hello"); }

TEST(UrlTest, UrlDecodeSpaceHex) {
  EXPECT_EQ(UrlDecode("hello%20world"), "hello world");
}

TEST(UrlTest, UrlDecodeHyphenHex) {
  EXPECT_EQ(UrlDecode("hello%2dworld"), "hello-world");
  EXPECT_EQ(UrlDecode("hello%2Dworld"), "hello-world");
}

TEST(UrlTest, UrlDecodeDollarHex) {
  EXPECT_EQ(UrlDecode("%24expand"), "$expand");
}

TEST(UrlTest, UrlDecodeIncompleteHex) {
  EXPECT_EQ(UrlDecode("hello%2"), "hello%2");
  EXPECT_EQ(UrlDecode("hello%"), "hello%");
}

TEST(UrlTest, UrlDecodeInvalidHexDigit) {
  EXPECT_EQ(UrlDecode("hello%2g"), "hello%2g");
  EXPECT_EQ(UrlDecode("hello%g0"), "hello%g0");
}

TEST(UrlTest, UrlDecodeHighAscii) {
  EXPECT_EQ(UrlDecode("%a0"), "\xA0");
  EXPECT_EQ(UrlDecode("%A0"), "\xA0");
}

TEST(UrlTest, SanitizeUrlResolvesOperators) {
  EXPECT_EQ(*SanitizeUrl(""), "/");
  EXPECT_EQ(*SanitizeUrl("/"), "/");
  EXPECT_EQ(*SanitizeUrl("/a/b/c"), "/a/b/c");
  EXPECT_EQ(*SanitizeUrl("/a/b/c/"), "/a/b/c/");
  EXPECT_EQ(*SanitizeUrl("a/b/c"), "/a/b/c");
  EXPECT_EQ(*SanitizeUrl("/a/./b/../c"), "/a/c");
  EXPECT_EQ(*SanitizeUrl("/a/b/../../c"), "/c");
  EXPECT_EQ(*SanitizeUrl("/a/b/../../../c"), "/c");
  EXPECT_EQ(*SanitizeUrl("/../a"), "/a");
  EXPECT_EQ(*SanitizeUrl("/a/b/%2e%2e/c"), "/a/c");
  EXPECT_EQ(*SanitizeUrl("/a/b%2f..%2fc"), "/a/c");
  EXPECT_EQ(
      *SanitizeUrl("/some/authorized/resource/%2e%2e/%2e%2e/unauthorized"),
      "/some/unauthorized");
  EXPECT_EQ(*SanitizeUrl("/some/authorized/resource%2f..%2f..%2funauthorized"),
            "/some/unauthorized");
}

TEST(UrlTest, SanitizeUrlPreservesQueries) {
  EXPECT_EQ(*SanitizeUrl("/a/b/../../c?param=1"), "/c?param=1");
  EXPECT_EQ(*SanitizeUrl("/a/b/../../c"), "/c");
  EXPECT_EQ(
      *SanitizeUrl("/some/authorized/resource/../../unauthorized?%24expand="),
      "/some/unauthorized?%24expand=");
}

TEST(UrlTest, SanitizeUrlRejectsInvalidCharacters) {
  EXPECT_EQ(SanitizeUrl("/some/authorized/resource/..%3f").status().code(),
            absl::StatusCode::kInvalidArgument);
  EXPECT_EQ(SanitizeUrl("/some/authorized/resource/..%23").status().code(),
            absl::StatusCode::kInvalidArgument);
  EXPECT_EQ(SanitizeUrl("/some/authorized/resource/..%00").status().code(),
            absl::StatusCode::kInvalidArgument);
}

}  // namespace
}  // namespace milotic